(S)AGE — Sovereign Agent Governed Experience

(S)AGE — Sovereign Agent Governed Experience

Image: SAGE: governed memory for AI agents, with a lavender neural brain

Memory your agents can be held to.

SAGE is a governed memory and messaging layer for AI agents. Every memory is signed by an agent, admitted through a reviewable process, scoped by permissions you set, and kept with an audit trail you can inspect.

Connect your tools to the same local node so authorized agents can record experience and recall relevant context in later sessions. Inspect what they keep in CEREBRUM, SAGE's local dashboard.

Works with Claude Code, Codex, Cursor and other MCP-capable clients. Developers can integrate through the Python SDK or signed REST API. Recall depends on what is recorded, your configuration and the agent's use of its tools.

Download SAGE · Get started · Connect your AI · Developer quickstart

Why SAGE · Quick Start · For Developers · Architecture · Capabilities · Dashboard · Release history · Documentation

<a href="https://glama.ai/mcp/servers/l33tdawg/s-age"> <img width="380" height="200" src="https://glama.ai/mcp/servers/l33tdawg/s-age/badge" alt="(S)AGE MCP server" /> </a>

Why SAGE

Use SAGE when your agents return to ongoing work: a design decision worth keeping, an approach that failed, or a lesson the next session should use. RAG retrieves source material; SAGE uses retrieval too, with a governed record of agent experience around it.

• Trace the origin. Agent-signed writes attribute memories to their recorded author.

• Review admission. Memories pass through a validation lifecycle before they enter normal recall.

• Control access. Enrollment, domain permissions and classification determine which agents can use a memory.

• Keep memory useful. Inspect confidence and status, apply decay, or deprecate a memory while retaining its audit history.

A personal install runs one validator and casts its own signed admission vote. A multi-validator network requires a BFT quorum. These checks govern what is committed; they do not prove every remembered claim is true or change your model's weights. See the memory lifecycle and consensus reference.

Memory is local by default. Optional federation, connectors and remote model providers can send data to configured destinations. Enable the vault for memory-content encryption at rest; see the privacy details and Security FAQ.

Quick Start

Desktop: Download the latest release, open SAGE and complete setup in CEREBRUM. Choose your memory engine, connect an AI client and review agent access. Follow the connection guide for your tool or the full Getting Started walkthrough.

If SAGE is already running, check it before starting another server:

curl http://127.0.0.1:8080/health

A healthy node returns {"status":"healthy"}. After connecting an MCP client, call sage_inception and follow its returned memory mode.

<details> <summary>Build from source</summary>

From source (Go 1.26.10+):

git clone https://github.com/l33tdawg/sage.git && cd sage
go build -o sage-gui ./cmd/sage-gui/
./sage-gui setup    # Pick your AI, get MCP config
./sage-gui serve    # SAGE + Dashboard on :8080

</details>

Desktop packages: macOS DMG (signed & notarized) | Windows EXE | Linux tar.gz

<details> <summary>Docker and containerized MCP setup</summary>

Docker

docker pull ghcr.io/l33tdawg/sage:latest
docker run -d --name sage \
  -p 8080:8080 \
  -v ~/.sage:/root/.sage \
  ghcr.io/l33tdawg/sage:latest

Pin a specific version with ghcr.io/l33tdawg/sage:11.25.6.

The SAGE server stays in that container. To give a local MCP client a stdio bridge, start a second process inside the same running container:

docker exec -i \
  -e SAGE_PROVIDER=claude-code \
  -e SAGE_PROJECT=my-project \
  -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
  sage /usr/local/bin/sage-gui mcp

For the shipped Compose stack, use the service name rather than a generated container name:

docker compose -f docker-compose.sage-gui.yml exec -T \
  -e SAGE_PROVIDER=claude-code \
  -e SAGE_PROJECT=my-project \
  -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
  sage /usr/local/bin/sage-gui mcp

If an MCP client launches this through a wrapper, point its stdio configuration at the wrapper's absolute path. Pass SAGE_PROVIDER, SAGE_PROJECT, and SAGE_IDENTITY_PATH through docker exec -e/docker compose exec -e; setting them only on the host-side Docker command does not place them in the container. Keep the whole SAGE data root mounted at /root/.sage, including agent keys and the ledger. Do not start a separate docker run ... mcp container: its localhost:8080 is isolated from the running SAGE server.

HTTP MCP is also available at /v1/mcp/sse and /v1/mcp/streamable, but both require a bearer token or OAuth. Bare http://localhost:8080 is the REST base, not an unauthenticated MCP endpoint.

</details>

<details> <summary>Upgrading an existing node</summary>

Upgrading from an older version?

Upgrading an existing node — including the v10.x → v11 jump — is docs/UPGRADING.md. In the desktop app, accept the update: SAGE verifies canonical upgrade compatibility, captures a full recovery snapshot, installs, and restarts automatically. Headless and quorum operators have separate technical procedures in the guide. Your chain advances in place; a personal node climbs the consensus fork ladder by itself. Read the guide before a multi-admin chain crosses app-v23 — that activation re-derives administrator authority.

If you installed SAGE before v5.0 and your AI isn't doing turn-by-turn memory updates, re-run the installer in your project directory:

cd /path/to/your/project
sage-gui mcp install

This installs Claude Code hooks that prompt the memory lifecycle (boot, turn, reflect) — even if your .mcp.json is already configured. Restart your Claude Code session after running this.

</details>

For Developers

Choose an integration for your workflow:

The authoritative reference index covers exact API behavior, authentication, access controls and lifecycle rules. Start there when implementing an integration.

Python: read existing memories

Requires Python 3.10+, a running node and an enrolled agent. Set SAGE_IDENTITY_PATH to that agent's existing key file and SAGE_DOMAIN to a domain it can read.

python -m pip install sage-agent-sdk

import os
from sage_sdk import AgentIdentity, SageClient

identity = AgentIdentity.from_file(os.environ["SAGE_IDENTITY_PATH"])
domain = os.environ["SAGE_DOMAIN"]

with SageClient(
    base_url="http://127.0.0.1:8080",
    identity=identity,
    trust_env=False,
) as client:
    page = client.list_memories(
        domain=domain, status="committed", limit=3,
    )
    for memory in page.memories:
        print(memory.memory_id, memory.content)

Save as quickstart.py and run python quickstart.py. An empty list means no committed memories are visible to this agent in that domain. Review enrollment and domain permissions in CEREBRUM if access is denied.

To record experience, use propose() in a domain the agent can write to and set classification explicitly. A submitted memory starts as proposed; normal recall includes it after admission commits it. For semantic retrieval, use hybrid() with query text and a matching embedding. See the SDK examples and memory admission guide.

Architecture

flowchart TB
    A["AI agents · MCP / SDK / REST"] --> P["SAGE node · authenticated admission + live policy"]
    H["CEREBRUM · local human control"] --> P
    P --> M["Memory + local policy transactions<br/>CometBFT / ABCI"]
    P --> W["Node-local coordination<br/>inbox / claims / replies"]
    M --> B["BadgerDB<br/>authoritative chain state"]
    B --> Q["Commit-time SQL projection<br/>content + vectors for authorized recall"]
    P -. "explicit peer trust and sharing" .-> F["Separate SAGE chain<br/>bounded Read / receiver-controlled Copy"]
    classDef entry fill:#eef2ff,stroke:#6366f1,color:#1e293b
    classDef memory fill:#ecfdf5,stroke:#059669,color:#064e3b
    classDef work fill:#fff7ed,stroke:#d97706,color:#7c2d12
    class A,H,P entry
    class M,B,Q memory
    class W,F work

Agents are not validators. Personal mode runs one real CometBFT validator with a per-node memory auto-voter; it has no Byzantine redundancy. Registering more agents does not add consensus voters. A multi-validator deployment runs one shared chain; federation connects separate chains under explicit policy.

Storage has two roles. BadgerDB is authoritative for consensus state. SQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content and vectors at Commit. Node-local message coordination is separate from the memory consensus path. Block inclusion is not the same as memory acceptance.

For the detailed trust boundaries, lifecycles, and deployment topology, see Architecture & Deployment.

Current Capabilities

How agents collaborate

flowchart TB
    T["Task assigned to exact agent"] --> N["One-way assignment notice"]
    N --> I["Unified inbox"]
    R["Request addressed to exact agent"] --> I
    I -->|"task notice"| V["Verify current assignment in backlog<br/>then update the task"]
    I -->|"inbound request"| C["Claimed by one MCP runtime"]
    C -->|"normal completion"| O["Idempotent reply"]
    C -. "intentional same-agent takeover" .-> H["Handoff: expected session + revision"]
    H --> O
    O --> S["Original sender reads reply_items<br/>or pages retained replies"]
    classDef input fill:#eef2ff,stroke:#6366f1,color:#1e293b
    classDef task fill:#ecfdf5,stroke:#059669,color:#064e3b
    classDef message fill:#fff7ed,stroke:#d97706,color:#7c2d12
    class I input
    class T,N,V task
    class R,C,H,O,S message

Assignment, claim, and reply are different states. A task notice is not a request for a message result, and a reply is not a new assignment. Runtime handoff does not reassign a task to another agent. Wake notifications are payload-free hints, not delivery or claim evidence. Every agent request and result remains untrusted data, not authority to expand the user's instructions.

See the MCP task/inbox reference and message/reply lifecycle for exact fields, recovery, and authorization rules.

CEREBRUM Dashboard

Image: CEREBRUM MRI brain — memories mapped inside a 3D brain with focused related notes

http://127.0.0.1:8080/ui/ — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.

The dashboard also includes governed agent enrollment, Access Groups, domain permissions, separate CEREBRUM Root credential handover, import/export, software updates, and encryption controls. Ordinary agent identity replacement uses re-enrollment; historical memory authorship is preserved.

<details> <summary>Recent release notes (v11.25.6 and earlier)</summary>

What's New in v11.25.6

Direct-grant inspection now follows canonical chain state. After app-v23, the ordinary grant-list endpoint takes domain, grantee_id, granter_id, access_level, and expires_at from Badger rather than the SQL serving mirror. A canonical grant is visible even when that projection is empty, and a canonical revoke disappears immediately instead of surviving as stale mirror data.

GET /v1/access/grants-snapshot/{agent_id} adds a bounded exact-target snapshot for reconciliation. One committed Badger read supplies the caller/target authorization records, current Root generation, height, AppHash, and active direct grants. The endpoint allows self-inspection or a current local Admin, fails closed on incomplete or oversized reads, and is deliberately not effective access, a global atomic directory, or a new protocol capability.

No consensus version change, app-version change, chain reset, or data migration. latest and automatic upgrade voting remain app29; app30 remains explicit. Container: ghcr.io/l33tdawg/sage:11.25.6. SDK 11.25.6.

What's New in v11.25.5

MCP inbox limits now explain themselves. sage_inbox keeps its bounded 1-20 limit for messages and task notices and for its passive reply page, but both caps are now explicit in the model-facing tool descriptions even when schema validation keywords are flattened. An out-of-range limit reports the submitted value and names the exact message_next_cursor and task_notice_next_cursor fields to use for continuation, so callers can page instead of repeatedly guessing a larger limit.

No consensus version change, app-version change, chain reset, or data migration. latest and automatic upgrade voting remain app29; app30 remains explicit. Container: ghcr.io/l33tdawg/sage:11.25.5. SDK 11.25.5.

What's New in v11.25.4

Snapshot retention now survives chain redeploys and stays bounded. Snapshot manifests record the chain identity, and snapshot list and automatic retention order captures by time rather than by height. A redeployed chain that restarts at height 1 therefore keeps its newest recovery points instead of losing them to obsolete high-height snapshots. Retention keeps the configured number of current chain captures plus a bounded set of recent version anchors. Recovery executables are limited to the current binary and one prior copy, with stale temporary copies reaped safely. New snapshots use schema v2; existing v1 snapshots remain readable.

Release-page refreshes now fail closed on stale editorial copy. The Pages snapshot job refuses to write a newer version stamp when the landing page's What's New block, FAQ, or version-pinned documentation links still describe an older release. Dynamic download counts remain automatic; release copy must move with them.

No consensus version change, app-version change, chain reset, or data migration. latest and automatic upgrade voting remain app29; app30 remains explicit. Container: ghcr.io/l33tdawg/sage:11.25.4. SDK 11.25.4.

What's New in v11.25.3

Memory submit now reports fields it did not apply. Unknown top-level body keys are still accepted and ignored for compatibility, but the response names them in a bounded, sorted ignored_fields array and the node logs a warning without their values. This makes a correction-shaped request visible when a client sends fields such as replaces_memory_id to a route that only stores the replacement memory. Corrections still use submit, wait for commit, then challenge the old memory.

The Go dependency baseline closes two high-severity pgx vulnerabilities. pgx moves to 5.12.0 for the simple-protocol batch SQL-injection and authentication-requirement fixes, with puddle 2.2.3. The SQLite driver moves to 1.61.1 for prepared-statement and read-only VFS correctness. The test-only PostgreSQL mock moves to its pgx-5.12-compatible v6 line.

No consensus version change or chain migration. latest and automatic upgrade voting remain app29; app30 remains explicit.

What's New in v11.25.2

Fresh-node setup imports now use the enrolled Companion identity. On a new post-v23 chain, the setup wizard's pending memories previously tried to embed and submit as the genesis Root, which is deliberately not an ordinary agent. The import now signs as the enrolled Companion, routes an unqualified entry to that Companion's home domain, and reports embed, submit, and zero-import failures at visible log levels instead of producing only Imported 0/N.

The optional local memory judge is pinned to v17b. The default-off managed judge now uses a separate immutable model artifact, verifies both the downloaded GGUF and Ollama's registered blob, and keeps explicit v16 selections unchanged. The v17b training pass targets the short user decisions and task-shaped memories that v16 often rejected or held, while retaining the chat-only and session-remark traps. New writing guidance is linked from the write-gate reference.

No consensus version change or chain migration. latest and automatic upgrade voting remain app29; app30 remains explicit.

What's New in v11.25.1

AMID can approve a distinct local agent. Operators can opt into --local-agent-key-dir (SAGE_LOCAL_AGENT_KEY_DIR) to supply identity-bound target consent keys to the existing access-policy route and Python SDK methods. Root authorization, same-machine checks, and consensus validation remain required. Unregistered targets are refused before signing or broadcast, and malformed Ed25519 private-key encodings fail closed.

Hybrid recall sizes reranking work from the requested results. The authorization scan retains its full candidate coverage while the cross-encoder scores the smaller requested pool. SAGE_RERANK_MAX_CANDIDATES adds an optional cap. Rate-limited fallback warnings expose operational failures without logging upstream error text or submitted content.

Explicit federation settings survive config saves. Disabled P2P, an empty relay list, and disabled force-private mode no longer disappear during serialization and revert to defaults on reload.

Force-quitting the macOS tray no longer leaves its daemon orphaned after startup. The tray identifies itself to its child; once graceful shutdown is ready, the daemon monitors that parent and stops if it disappears. Standalone and externally supervised daemons remain independent unless explicitly configured with the parent relationship.

No consensus version change or chain migration. latest and automatic upgrade voting remain app29; app30 remains explicit. Existing reply catch-up and v11.24.4 fixes are already included through release history.

Container: ghcr.io/l33tdawg/sage:11.25.4. SDK 11.25.4.

What's New in v11.25.0

Fresh chains start at the supported app version. A new personal sage-gui serve starts directly at app29. For a shared chain, create one signed, full-roster artifact with init-genesis, then run init-fresh-node on each Unix node against its exact genesis digest before starting serve. Existing chains keep their keys, genesis and governed upgrade history. See the fresh-genesis guide.

App30 taint and authenticated lineage ship as explicit rules. The merged implementation includes immutable multi-parent derived_from references, governed apply/clear decisions, bounded canonical traversal, provenance and recovery/state-sync support. latest and automatic upgrade voting remain at app29; an explicit signed app30 genesis or quorum-approved plan selects app30.

The native-shell control contract accepts v11.25 daemons. Native standalone packages retain their preview identity and separate promotion requirements. Evidence-operator integration and complete count, coverage and error parity across clients/backends remain open in #460.

Container: ghcr.io/l33tdawg/sage:11.25.0. SDK 11.25.0.

What's New in v11.24.5

Task identity is now domain-aware. App-v23 tasks use their permanent idempotency identity—caller, exact signed domain, canonical [TASK] content, or an explicit occurrence key—instead of the global memory-content tombstone. The same task body can exist as a distinct task in another governed domain without being deprecated after consensus.

Deprecated tasks can no longer mutate. REST and the SQLite and PostgreSQL stores reject claim, completion, and status changes on deprecated task rows, so a full-ID update cannot report success against a task that has disappeared from the backlog.

No app-version or data migration. App-v29 remains active. Container: ghcr.io/l33tdawg/sage:11.24.5. SDK 11.24.5.

What's New in v11.24.4

macOS restarts now recover without Activity Monitor cleanup. The tray keeps sage-gui serve supervised, restarts unexpected exits with bounded backoff, detects a live child that stops answering health checks, and retains the unlocked passphrase for the replacement process. Daemon logs are appended so a failed restart keeps its evidence.

Shutdown no longer lets transport teardown strand an update. MCP HTTP and federation P2P close stages are bounded. A timeout is logged without rolling back an otherwise valid update or preventing the replacement process from starting.

CEREBRUM makes the restart wait visible. The updater now shows a live five-minute countdown and phase-specific status while SAGE finishes in-flight work, closes its listener, starts the replacement, and reconnects. The countdown keeps moving even while a request or health probe is waiting on the network.

No consensus change or chain migration. App-v29 remains active. Container: ghcr.io/l33tdawg/sage:11.24.4. SDK 11.24.4.

What's New in v11.24.3

AMID exposes the signer-fence recovery surface without requiring CEREBRUM. Operator-only GET /v1/dashboard/signer-fence/status, POST /v1/dashboard/signer-fence/lift, and POST /v1/dashboard/signer-fence/abandon routes now serve the cluster runtime. The exact configured governance operator must sign each request; caller-supplied proofs and evidence are rejected, request bodies are bounded, and the node rereads committed nonce, transaction, mempool, and peer state before every recovery decision.

AMID health now follows the external Comet engine. After the chain identity binds, AMID continually probes the configured CometBFT RPC /health, clears its Comet health bit on failure, and restores it after recovery. The compose validators use restart: unless-stopped, preserving deliberate operator stops while restarting unexpected exits.

Public SAGE-Noesis outcome receipts establish an evidence-only interop boundary. Receipt v1 is public-only, signed, off-consensus, and carries no REST or MCP route. It records reproducible control/treatment evidence without granting valuation, stake, governance, access, or memory authority to Noesis.

No consensus change or chain migration. App-v29 remains active. Container: ghcr.io/l33tdawg/sage:11.24.3. SDK 11.24.3.

What's New in v11.24.2

PostgreSQL stats now exclude deprecated memories from totals and per-domain counts, matching SQLite. Status counts and last activity retain their audit history.

CEREBRUM timelines now include in-range memories at fractional-second date boundaries. Whole-second and fractional bounds keep exact inclusive timestamp checks and canonical visibility checks.

No consensus change or chain migration. App-v29 remains active. Container: ghcr.io/l33tdawg/sage:11.24.2. SDK 11.24.2.

What's New in v11.24.1

App-v29 now activates automatically after its evidence gates pass. The auto-vote readiness ceiling moves from app-v28 to app-v29, so personal nodes converge on the architecture-independent PoE arithmetic already compiled in v11.24.0. The activation block keeps app-v28 behavior; deterministic EWMA, recency, corroboration, logarithm, exponential and final-weight calculations begin at H+1. Historical blocks continue to replay under their original app versions.

The app-v29 evidence spans the real failure surfaces. A four-validator ladder crosses app-v2 through app-v29 with byte-identical AppHash at H-1, H and H+1, then continues through the first post-activation PoE epoch. A separate quorum runs two validators and CometBFT processes on arm64 and two on amd64 against one chain. The real-process crash, partition, restart and state-sync gate targets exact app-v29 state.

The patch closes the release security gaps. Go 1.26.10 fixes GO-2026-6809 in crypto/x509; certifi 2026.10.19 removes the compromised emSign intermediate CA bundle from all benchmark environments; and the dependency group updates chi, klauspost/compress, go-winio, Playwright and pinned GitHub Actions.

No chain migration. Existing memories, identities, governance state and chain history are preserved. Container: ghcr.io/l33tdawg/sage:11.24.1. SDK 11.24.1.

What's New in v11.24.0

PoE weights now have an architecture-independent path. App-v29 compiles a new consensus form of the proof-of-experience arithmetic: EWMA state updates, recency, corroboration and final weights use explicitly rounded operations that produce the same float64 bits on arm64 and amd64. The gate remains dormant above the app-v28 auto-vote ceiling, so existing chains keep their current app version and historical blocks keep replaying under their original arithmetic until the mixed-architecture, replay, snapshot and state-sync evidence is complete. CI and release workflows now run exact golden vectors on native amd64 and arm64.

Org fleet enrollment Phase 1 lands. Organizations can issue 24-hour, single-use tokens bound to one exact node key and immutable policy scope. Redemption atomically stores the consume marker, replayable result and first signed policy in node-local SQLite; concurrent attempts cannot overwrite the winner, and a lost response can be replayed even after token expiry or revocation. Signed policy delivery adds monotonic revisions, rollback protection, persisted rotation history and overlap, a durable owner-visible equivocation alarm, and per-operation offline/expiry gates for enrollment and new peering. sage-gui org-token create|list|revoke exposes the operator flow.

No chain migration. App-v28 remains active and app-v29 remains compiled but dormant. Existing memories, identities, governance state and chain history are preserved. Container: ghcr.io/l33tdawg/sage:11.24.0. SDK 11.24.0.

What's New in v11.23.27

Find the exact MCP session before a handover. sage_sessions is a new read-only, self-only inventory of this agent's live MCP claimant sessions on the local node. It returns each exact session_id, transport kind, provider/project, whether it is the current session, liveness from the same OS advisory lock used by claimant identity acquisition, and the exact count of unfinished claims held by that session. Stale identity records are counted separately and are not presented as live sessions. The tool never claims, hands off, replies, or grants authority; session IDs remain coordination metadata, not authorization principals.

Access Group controls say what they do. CEREBRUM's Access Group editor now labels its close and delete actions accurately instead of putting Delete in the conventional close slot.

No chain migration. App-v28 remains active. The MCP catalog grows to 38 tools; clients with a cached catalog should re-list or reconnect. Container: ghcr.io/l33tdawg/sage:11.23.27. SDK 11.23.27.

What's New in v11.23.26

App-v28 activation now succeeds on legacy public corpora. The public-memory stage is built before the activation block's consensus transaction, so a record it could not encode aborted the activation on every replay and left the pending plan with no in-band downgrade. Records born before app-v25 whose canonical envelope lacks a domain, author, or author principal, carries a non-32-byte content hash, or carries a co-commit tombstone are now quarantined out of the committed public set instead of refusing the build. Records born under app-v25 or later still fail closed, and a recorded-but-empty or malformed field still refuses on every record. A record returns to the public set in the block that re-anchors its envelope.

Preflight now checks the corpus before the fork. sage-gui upgrade preflight runs the same read-only census as sage-gui upgrade public-memory-audit when a chain still has to cross app-v28, and refuses "clear to climb" when a record would block activation. The audit names every record, the exact failed checks, and whether the stage would quarantine or refuse it. --limit bounds the printed list; the counters still cover the whole corpus.

Quarantined records are visible, not silent. The audit reports them by memory id, and they stay outside the app-v28 public-memory tree until re-anchored. No chain migration is required; app-v28 remains active.

Container: ghcr.io/l33tdawg/sage:11.23.26. SDK 11.23.26.

What's New in v11.23.25

Unscoped recall works again on a mature node. An app-v23 node refuses a ranked recall whose candidate set exceeds its authorization scan budget rather than ranking an arbitrary prefix. On a node with a large corpus that made a domainless sage_recall fail permanently — the tool's default shape. Recall now falls back once to your governed home domain and reports the effective scope in domain, recall_scope and recall_scope_note, so an empty home-domain result is never read as proof the memory does not exist elsewhere. An explicitly scoped recall is never redirected.

Federated recall is bounded, and says why it is empty. /v1/federation/recall-plan now carries a server-side deadline with a per-peer budget, so one unreachable peer can no longer hold the request open until the caller gives up. An empty plan reports unavailable_reason — no_active_agreement, requested_chains_not_connected, peer_unreachable, domain_not_shared, planner_unavailable or federation_unavailable — instead of an empty error map that read as an authorization verdict. The reasons are aggregate by design and never name a peer.

Federated agents appear inside their Access Group. A federated agent linked to a local Access Group is now shown with the local members, with its authority stated. Federated write remains unavailable: it requires a consensus-bound federation ingress capability.

Product-specific bootstrap policy leaves core. A root-owned provisioning profile now drives init-fresh-personal-sage and check-private-config. SAGE core no longer carries any one product's home path, Unix account, or unit list. Products that shipped init-lantern-private must ship the profile and update their scripts before pinning this release.

App-v28 remains active and no chain migration is required.

Container: ghcr.io/l33tdawg/sage:11.23.25. SDK 11.23.25.

What's New in v11.23.24

Find agents across connected SAGEs in one call. sage_find_agent(name="...") searches this SAGE and caller-authorized contacts on connected SAGEs together by default. Exact name matches rank first in one bounded list. Local matches no longer hide remote matches, and same-named agents keep distinct exact addresses so you can choose the intended recipient.

Use scope="local" to search only this SAGE, or peer_chain to select one connected SAGE. If federated discovery cannot be verified, local matches remain available with an explicit incomplete flag. Cached contacts retain their caller-specific authorization checks, and each continuation still reads one bounded peer page.

MCP descriptions and message guidance now point to the combined lookup. After upgrading, re-list tools or reconnect clients with a cached catalog to load the new parameter and guidance. App-v28 remains active and no chain migration is required.

Container: ghcr.io/l33tdawg/sage:11.23.24. SDK 11.23.24.

What's New in v11.23.23

Close reviewed notices without replying. sage_message_close(message_id, reason) records an explicit “closed without reply” outcome for informational or withdrawn messages. Closing retains history and clears pending and unfinished inbox reminders across sessions and restarts. Exact-recipient pending messages need no claim; existing claims remain protected by their current session.

The close reason stays in recipient history and uses the content vault when enabled. Closures create no reply, read receipt, or sender reply activity. Inbound federated closure is local to the receiving SAGE. REST and both Python clients expose the same action, and startup nudges explain when to use it.

App-v28 remains active and no chain migration is required. Clients with a cached tool catalog re-list or reconnect to discover the new action.

Container: ghcr.io/l33tdawg/sage:11.23.23. SDK 11.23.23.

What's New in v11.23.22

Choose which agents a peer can find. Federation visibility uses the complete eligible roster instead of general registry entries that could make a partial selection fail. Search by name, provider, or ID, filter Visible/Hidden, and change an individual agent or only the agents matching your filters.

Review choices in one place. Compact rows, Save/Discard, and inline refresh controls keep visibility edits together. Filtered rows stay in place until saving, preserving keyboard focus. The peer's contacts have their own read-only view, while optional memory sharing and access settings are collapsed separately. Agents whose security policy blocks messages remain marked Not accepting.

Individual and filtered choices stay an exact selection, even when all current agents are selected. Show all agents explicitly includes future eligible agents. Visibility grants discovery only; memory access and message delivery keep their existing authorization checks.

App-v28 remains active and no chain migration is required.

Container: ghcr.io/l33tdawg/sage:11.23.22. SDK 11.23.22.

What's New in v11.23.21

Reliable inbox reply catch-up. The inbox now returns an explicit reply_watermark_candidate to save after processing the complete reply range. Its safety flags describe that inbox response and stay fixed while you page. For a truncated reply page, continue until sage_message_replies returns page_truncated=false, then use the candidate from the original inbox response as the next reply_since. An already complete inbox page needs no pager call. This replaces guidance that could send clients through the retained archive repeatedly.

Paging keeps its bounds. Each continuation supplies the next cursor with the same inclusive since and page limit. If the retained-reply pointer has no valid head, a returned reply page can still supply a candidate; a response with no valid candidate tells the client to omit reply_since on its next poll. Replies at the inclusive boundary remain deduplicated by message ID.

Clients carrying a tool catalog from before inbox v3 must re-list tools or reconnect to discover the existing sage_message_claim and sage_task_notice_ack actions. The server already advertises those tools and sends its tool-list change notification during runtime handoff.

App-v28 remains active and no chain migration is required.

Container: ghcr.io/l33tdawg/sage:11.23.21. SDK 11.23.21.

What's New in v11.23.20

Reading the inbox leaves work pending. sage_inbox now inspects messages and task notices without claiming messages, marking notices read, or creating a reply obligation. Agents accept one authorized message with sage_message_claim(message_id) and acknowledge one reviewed task notice with sage_task_notice_ack(notification_id). Message and task-notice pages advance independently, so a busy message inbox cannot hide task notices.

Agent integrations use the explicit acceptance contract. The old sage_messages_receive MCP tool is removed. Hooks, startup guidance, the Claude channel and the Python SDK use passive inspection; clients must explicitly claim a message before replying. Session ownership, signed federated receipts and recovery of existing claims remain enforced. Reconnect MCP clients after updating so they discover the 36-tool inventory.

Source builds and release builders move to Go 1.26.9, and both Go modules use golang.org/x/net v0.60.0 for the patched standard-library and HTTP/2 dependencies.

App-v28 remains active and no chain migration is required.

Container: ghcr.io/l33tdawg/sage:11.23.20. SDK 11.23.20.

What's New in v11.23.18

SQLite dependency maintenance. The SQLite driver moves to 1.60.1 with its matching libc dependency. This includes WAL shared-memory read-fault handling that returns an I/O error instead of crashing, plus faster argument binding for statements with many parameters. The embedded SQLite engine remains 3.53.4; Go tooling dependencies are also refreshed.

Reranker allocation checks. The reranker keeps its existing limit of 1,000 results. Its result slice now grows only within the capped selection loop, with no input-sized preallocation. Regression tests cover extreme limits, empty and oversized candidate pools, upstream failures and malformed scores.

The optional LoCoMo and LongMemEval benchmark environments now pin datasets==5.0.1, addressing GHSA-379c-qx7v-6h59 / CVE-2026-66007. Browser fixture tests use Playwright 1.63.0.

No consensus execution change, app-version change or chain migration; app-v28 stays active. The experimental, default-off local judge remains pinned to v16, with its runtime, thresholds and published qualification limits unchanged.

Container: ghcr.io/l33tdawg/sage:11.23.18. SDK 11.23.18.

What's New in v11.23.17

The optional local judge is now pinned to v16. On the disclosed frozen 40-item synthetic regression set, the attributed tank-warning example moves from rejection to operator review. All 18 genuine examples avoid rejection: 16 pass and two hold. All 22 negative examples still reject. These results were independently measured on Linux/arm64 with Ollama v0.31.1; they do not establish fresh-holdout accuracy or qualify production installation on every platform.

Select SAGE_LOCAL_JUDGE_MODEL=sage-memory-judge:v16 to use the new pin. The memory gate remains experimental and off by default; upgrading does not rewrite an explicit v15 setting. The download uses an immutable Hugging Face revision with separate SHA-256 pins for the downloaded GGUF and Ollama's registered blob. Thresholds, serving template and runtime are unchanged. See the memory-gate guide and v16 regression results. Thanks to @ihubanov for the update.

No consensus execution change, app-version change or chain migration; app-v28 stays active.

Container: ghcr.io/l33tdawg/sage:11.23.17. SDK 11.23.17.

What's New in v11.23.16

Task creation starts at 0.90 across MCP. When confidence is omitted, sage_remember(type="task") now matches sage_task; other memory types keep their 0.80 default. Corrections resolve the inherited memory type before choosing the default. Explicit scores, including 0 and 0.80, are preserved; malformed, non-finite and out-of-range scores are rejected. The tool schema describes the conditional defaults without inserting a fixed value that could override correction inheritance.

Submission receipts report the score that was signed. submitted_confidence appears on submitted sage_remember writes, including corrections and indeterminate outcomes, and on sage_task creation, replay and committed-but-unconfirmed receipts. It describes the request, not a later stored or query-time score. Skipped or rejected pre-validation and task-status updates do not report a submitted score.

Existing memory scores and task idempotency checks remain intact. There is no consensus execution change, app-version change or chain migration; app-v28 stays active and the qualified v15 local judge pin is unchanged.

Container: ghcr.io/l33tdawg/sage:11.23.16. SDK 11.23.16.

What's New in v11.23.15

MCP stdio bridges exit when their client process dies. Inherited pipes can keep a bridge's input open after its client has gone. SAGE now watches the original parent process, cancels its tools and subscriptions on confirmed parent exit, and bounds cleanup even when input or output is blocked. An idle client keeps its bridge.

Correction lineage resolves by content hash in CEREBRUM. The graph and related-memory view find the parent of a correction through bounded metadata lookups on SQLite and PostgreSQL. Legacy exact-ID pointers still work; ambiguous hashes and hidden parents do not expose a lineage edge or memory body.

A malformed reranker response preserves the original recall results. Missing, duplicate or invalid candidate indices and non-finite scores now discard the reranking response as a whole, keeping the existing reciprocal-rank-fusion ordering. The optional reranker remains off by default; its guidance now asks users to compare relevance and latency on their own queries.

Federation and message failures explain the next step. Local storage and target-resolution failures, plus failed requests to known peers, include bounded diagnostics and remedies. Route diagnostics report only attempted candidates and omit credentials, payloads and peer response bodies. Messaging controls also explain that blocking delivery does not hide an agent from discovery.

The release removes unused memory-transition helpers, expands bounded CI coverage, and documents reproducible retrieval benchmarks and the limits of the public research artifacts. No consensus execution change, app-version change or chain migration; app-v28 remains active. The local judge model stays pinned to the qualified v15 artifact.

Container: ghcr.io/l33tdawg/sage:11.23.15. SDK 11.23.15.

What's New in v11.23.14

MCP tool calls stay responsive while another tool waits on HTTP. Stdio now runs up to 16 tool requests concurrently and reads cancellation notifications immediately. A slow history read can no longer hold later independent tools or the tool registry behind it. Cancellation stops the matching request context; an indeterminate write still requires its normal reconciliation.

AMID restores unresolved signer fences before it starts serving. A private, node-local SQLite ledger preserves identity-only submission intents across process exits. Startup refuses an unreadable or malformed ledger, and a restored fence settles only on chain-proven fate. Disabling the REST validator key also removes the inherited key from ordinary signing paths. A proven fence finishes its durable cleanup before reopening the signer, so a fast next submission cannot lose its new recovery record to the prior cleanup.

Block sync rounds quorum-blocking power up correctly. A validator with power 1 out of 4 no longer leaves block sync early. Actual quorum-blocking power keeps its existing behavior.

An optional local judge checks lasting knowledge and its submitted evidence. Set SAGE_LOCAL_JUDGE_MODEL=sage-memory-judge:v15 to use SAGE's verified local model through its managed Ollama runtime. It remains experimental and off by default. Judge traffic is restricted to loopback, cloud aliases and mismatched model blobs are refused, and an unavailable judge holds proposals for operator review. Public seed-set qualification on SAGE's pinned runtime passed with external networking blocked; support precision was 97% with one accepted trap, and lasting precision was 100%. See the memory-gate guide and runtime qualification report for configuration and limits. Thanks to @ihubanov for the contribution.

No consensus execution change, app-version change or chain migration.

Container: ghcr.io/l33tdawg/sage:11.23.14. SDK 11.23.14.

What's New in v11.23.13

REST submissions keep their acknowledgment through the full write budget. A memory could commit after the server's response deadline had expired, leaving the caller with a connection error instead of the result. The deadline now accounts for embedding retries, the bounded nonce-lease wait and the consensus commit wait, with time for the response. The default is 285.75 seconds and the combined budget is capped at ten minutes; larger custom settings can still outlast that cap.

Vault recovery verifies the key before replacing vault.key. An invalid recovery key is refused before it can overwrite the existing vault key file.

This patch retains the memory gate shipped in v11.23.11. The unreleased evidence checks, managed local judge and model work are deferred. There is no consensus execution change, app-version change or chain migration. The cancelled v11.23.12 tag remains unchanged.

Container: ghcr.io/l33tdawg/sage:11.23.13. SDK 11.23.13.

What's New in v11.23.11

An optional memory-quality gate can hold uncertain memories for review. Set SAGE_HUNCH_URL to enable a background judge for proposed memories, with domain include/exempt settings controlling which memory text reaches the service. Built-in checks still run on every vote, and Settings → Memory gate lets the operator accept or reject held memories. The gate is off by default, supports SQLite stores, and does not change consensus or recall. See the memory-gate guide for configuration and limits. Thanks to @ihubanov for the contribution.

A provably stale memory vote can release its signer fence. When a vote's target has already committed, a stale-vote mempool filter can reject every retry before it reaches an indexed block result. SAGE now recognizes a narrow, versioned refusal for complete canonical memories submitted after app-v25 activation. The resolver binds that refusal to the exact signed vote and rechecks the transaction index before reporting its outcome. Ordinary CheckTx 13 errors and historical or incomplete targets keep the fence held.

CLI help is inert. Asking for serve --help, setup --help, or mcp --help returns usage before command dispatch, configuration, or instance locking, without creating home or project files.

Inbound federated messages wake their exact local recipient. Wake allocation commits atomically with message admission and transport deduplication. Duplicate or rolled-back deliveries cannot create extra wakes, and startup catches up existing unfinished inbound work.

No consensus execution change, transaction-type change, upgrade height, or chain reset. AMID operators must preserve unresolved transaction identity and signed bytes during maintenance: cmd/amid does not wire the durable-intent restore hooks used by sage-gui, so restarting it is not a fence-recovery proof.

Container: ghcr.io/l33tdawg/sage:11.23.11. SDK 11.23.11.

What's New in v11.23.10

A held signing key can no longer park the node's whole write path. A signer fence refuses every write from its key while it waits for proof of an earlier submission's fate, and that wait was bounded only by the caller's context — which the submit path passed as context.Background(), a context that never cancels and carries no deadline. The one goroutine holding the node's single signing lease sat there for as long as the fence stood — one observed node carried handlers parked 122–768 minutes — and every later writer for that key queued behind it on the same size-one lease, including the automatic reconciler whose job is to settle the fence and release it, so the hold could not clear itself. Reads stayed fast and denied writes still failed fast, which is why the incident reached the operator as writes time out, no error. WithNonceLease now derives a bounded wait (90 s) when the caller supplies no deadline, so a held fence fails retryable instead of parking, the lease is released, and the reconciler is no longer starved by the fence it exists to lift. A caller that supplies its own shorter deadline keeps it.

Background work the embedded web handler starts can no longer outlive the store it writes to. That handler started goroutines with no lifecycle owner, and unowned work that outlived its caller's store touched a closed database and panicked the process — first seen inside this repository's own suite, where one test's projection audit tore down another test's store. Unowned background work is counted now, and a caller that owns the stores drains it with WaitBackground before closing them.

Build and tooling. Local make builds pin to the host architecture instead of assuming amd64, and a Codex session started in a checkout inherits that checkout's Codex pin from .codex/config.toml — the counterpart of the existing .mcp.json Claude Code pin, so one workspace can carry both providers' pins. Dependency groups were refreshed.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.10. SDK 11.23.10.

What's New in v11.23.9

CEREBRUM now shows a held signing key. A signer fence refuses every write from its key and every coordinated restart while it waits for proof of an earlier submission's fate, and until this release the dashboard said nothing about it — the field report that produced the fence workstream read from the outside as reads are fine, writes time out, no error. System Status gains a row that appears only while a key is held: how many keys and how long, the node's own explanation of why the hold is deliberate, and one line per fence naming its resolution. reconciling means the identical bytes are still being re-submitted and it clears itself; waiting on proof means the signed bytes did not survive the process, so the chain or an operator has to settle it. Each line carries the nonce, how long the key has been held, the attempt count and the last recorded detail.

A hold that ends stays visible. The row above disappears with the fence, which left no way to tell it lifted while I was reading from it never happened. The last resolution is now kept and rendered — committed, rejected, spent, or resolved without a proof — so a fence that cleared itself is still on screen afterwards.

Two details that make the numbers trustworthy. The nonce crosses the wire as a string: SAGE nonces are nanosecond allocations that exceed JavaScript's safe integer range, and as a JSON number it reached the browser silently rounded, in the one place the operator compares it against the chain. And the panel never suggests restarting to clear a hold — a restart discards the fence and loses the transaction it protects, which is the failure the whole mechanism exists to prevent.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.9. SDK 11.23.9.

What's New in v11.23.8

A node stops manufacturing signer fences on an ordinary quit. Since the fence landed, every coordinated restart has drained signing before it committed, so its teardown could not sever a broadcast mid-flight. A plain signal or a serve error had no such drain: the HTTP force-close could catch a submission, raise an indeterminate outcome, write a durable fence record, and cost that payload at the next start — the fence can only lift on a proof, and a live one whose re-submission is refused by anything other than the nonce gate has no proof to reach. The ordinary exit now drains the same way the restart does: signing is quiesced, in-flight submissions get a bounded five-second window to finish, and only then do the listeners close. Signing is deliberately not resumed, because the process is leaving; an operator-ordered exit is never vetoed by the drain; and a submission that cannot finish in the window fails closed onto the durable record and the restored fence.

sage-gui fence abandon works on a node that keeps a peer. The credential-free operator exit added in 11.23.6 applies the same evidence gate as the daemon's abandon route, including its second acknowledgement for connected peers — a peer is a route the abandoned bytes could still take back into this node's mempool. The CLI had no way to carry that acknowledgement, so on a federated desktop node or a validator with a persistent peer it could only ever refuse and point at a field it had no way to set. --peer-redelivery-acknowledged now carries it, fence list names the requirement when peers are connected, and every unproven record states the restart step: a running daemon keeps holding the key until it restarts, and the durable record is what the next boot restores from.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.8. SDK 11.23.8.

What's New in v11.23.7

A node that has activated app-v28 can install its own updates again. The signed update flow takes a pre-upgrade recovery snapshot and proves it before it touches the installed app: the manifest carries the AppHash the running chain committed, and the proof restores the Badger backup and re-derives that digest from the restored bytes. Since app-v28 the committed AppHash is the public-memory composite commitment — the app-v13 digest of the state WITHOUT the public-memory index nodes, composed with the sparse index root — and the proof only knew the three earlier eras. Every app-v28 node therefore refused its own recovery snapshot, and the field report was exactly this shape: Failed to install signed app update: verify pre-upgrade snapshot: ... AppHash mismatch under every hash rule (legacy/app-v12/app-v13), with the update stuck on the snapshot step and no way forward from inside the app.

What now happens: the composite joins the candidate set, read through the same internal/store implementation the commit path uses instead of a second copy of the rule — the state-sync provider verification path already went stale exactly that way once, refusing every v28 provider while every pre-v28 chain stayed green. A pre-v28 state carries no public-memory commitment, so the composite is reported as not-applicable there and the three older candidates decide alone. The mismatch message now names the rules that were actually tried.

If you are reading this from an app-v28 node on 11.23.6 or earlier, read this part. The gate that just failed runs inside the binary you have installed, so that binary cannot install this release either — and the same gate vetoes a version-changing restart. Installing 11.23.7 once by hand is the path out: quit SAGE, drag SAGE.app from the DMG into /Applications, relaunch. Every update after that one works from inside the app again.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.7. SDK 11.23.7.

What's New in v11.23.6

A fence on a quiet chain settles itself, and the operator has a way in when it cannot. SAGE chains are idle by design: since app-v12 every node sets create_empty_blocks=false, so a block is minted exactly when a signed transaction enters the mempool and the chain sits still otherwise. A fence restored from durable intent refuses to sign, and its signed bytes did not survive the process — so on a chain that was already quiet when the fence was raised, the fence was holding the only thing that could produce the proof it was waiting for. No transaction meant no block; no block meant no committed hash and no advanced committed nonce. The key was held forever, every write and every cleanup on that node was refused, and the field report was exactly this shape on a single-validator personal node.

What now happens: when the node is caught up, has no peer and has seen none while this fence was held, holds no mempool copy of the transaction, sees no committed fate for its hash and holds an unspent allocation, the node settles the fence itself, records fence_abandoned and the full evidence, reserves the abandoned allocation so the next transaction cannot reuse it, and lets the next write mint the block that wakes the chain. TWO EVIDENCE SETS REACH THAT DECISION and the log names which one did: mode=automatic_unprovable is the original startup resolution, and mode=automatic_quiescent is the rule added here for a chain that has minted nothing since the fence was raised — the first now succeeds where it previously could not, because the reader defects below were what stopped it reaching its gates.

What still holds the fence: a tip that has minted since the fence was raised, any connected peer, a peer seen under this fence, a mempool that holds the transaction — that is a chain with something to mint and the fence is what stops it, so it stays an operator decision — a node still catching up, a tip that cannot be read, a live fence whose exact bytes still exist, and any record without a nonce.

Every outcome of the automatic route is now visible. Its refusal reason reaches the fence's last_detail, and so does a FAULT — the fault branch was previously dropped silently, which made a node whose self-heal could not read its own evidence look identical to one that was merely waiting. A field report read that as "the automatic route never ran".

The operator has a real entry. sage-gui fence list prints every recorded fence with its signer, transaction, nonce and age, and says whether the chain can already settle it. sage-gui fence abandon --signer <key> --reason <why> --acknowledge-payload-loss retires one record from the node host through the same evidence gate the daemon's operator route applies — no credential, no browser, and it says plainly that a running daemon keeps its in-process fence until it restarts. This closes a field gap: the dashboard had no control for this action, and an HTTP MCP bearer token is not accepted by the operator gate, so the only local entry was a browser console.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.6. SDK 11.23.6.

What's New in v11.23.4

A fence on a quiet chain settles itself. SAGE chains are idle by design: since app-v12 every node sets create_empty_blocks=false, so a block is minted exactly when a signed transaction enters the mempool and the chain sits still otherwise. A fence restored from durable intent refuses to sign, and its signed bytes did not survive the process — so on a chain that was already quiet when the fence was raised, the fence was holding the only thing that could produce the proof it was waiting for. No transaction meant no block; no block meant no committed hash and no advanced committed nonce. The key was held forever, every write and every cleanup on that node was refused, and on a single-validator personal node the hold had no exit at all — the operator route needed a credential the operator could not present.

What now happens: when the node is caught up, has no peer and has seen none while this fence was held, holds no mempool copy of the transaction, sees no committed fate for its hash, holds an unspent allocation, and the chain's tip was minted before this fence was raised, the node settles the fence itself, records the decision as fence_abandoned with mode=automatic_quiescent and the full evidence (including the tip height and time), reserves the abandoned allocation so the next transaction cannot reuse it, and lets the next write mint the block that wakes the chain.

What still holds the fence: a tip that has minted since the fence was raised (that chain can still speak to these bytes), any connected peer, a peer seen under this fence, a mempool that holds the transaction — that is a chain with something to mint and the fence is what stops it, so it stays an operator decision — a node still catching up, a tip that cannot be read, a live fence whose exact bytes still exist, and any record without a nonce.

No consensus change, no transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.4. SDK 11.23.4.

What's New in v11.23.3

The fence fixes now reach the nodes that keep a peer. v11.23.3 could prove a restored fence's fate and settle the shape no proof can reach — but only on a node that had never seen a peer since it started, and its operator abandon route refused outright whenever any peer was connected. A federated desktop node, or any validator with a persistent peer, therefore sat behind a fence that no proof could settle with both recovery routes closed: writes refused, updates vetoed, indefinitely. That is the report this release answers.

The peer observation is anchored to the fence, not to the process. A sighting from an earlier outage — a peer that connected while the node was starting, a peer gone for hours — can no longer switch self-healing off for every fence raised afterwards. What still holds is the honest rule: the automatic route refuses while a peer is connected, or was seen while this fence was held, because a peer is how a transaction gets delivered back.

The operator abandon route now says what it needs. It reads the live peer count, still records it with the decision, and requires a second, explicit acknowledgement — peer_redelivery_acknowledged — when peers are connected. The operator can see the topology (whether that peer was running when the submission went out, whether it ever held the bytes); the node cannot, so it states the route it cannot rule out instead of refusing by construction.

The health surface says HOW a fence ends. Each held fence now reports a resolution class: reconciling means the node still holds the exact signed bytes and is re-submitting them until consensus answers, so it clears itself; proof_or_operator means the fence was restored from durable intent and its signed bytes did not survive, so only a chain-read proof or an explicit operator abandon will lift it. The block's explanation is rendered from that distinction instead of promising self-healing for every fence, and the automatic route's own refusal reason (still catching up / peers connected / a peer seen under this fence) is recorded with the fence rather than computed and dropped.

Agents can read it directly. The MCP surface gains a read-only sage_node_health tool (the 35th): it forwards the node's signer_fences block and renders the guidance from the resolution class, and says "not knowable from here" rather than guessing on a node too old to report one. A write refused with 503 Signing key temporarily held can now be diagnosed by the agent that hit it, without an operator shell.

No consensus change, no transaction-type change, no upgrade height, and no chain reset: this decides when a key may sign again, not what the chain accepts.

Container: ghcr.io/l33tdawg/sage:11.23.3. SDK 11.23.3.

What's New in v11.23.3

A held signing key can no longer strand a node, and a write that hits one says so. The signer fence refuses to let a key sign anything new while an earlier transaction's fate is unproven — that part is deliberate and unchanged. What was wrong was everything around a fence that got restored after a restart: its signed bytes are gone, so re-submission cannot prove anything, and the node had no other way to settle it. It held the key, refused every coordinated restart (which is every in-app update), and the only exits were an operator POST that needed a proof the chain did not have, or hand-editing the database. Users hit it as an upgrade that could not be installed and, on the nodes that did restart, as writes that timed out with no error while reads stayed fine.

A restored fence now proves what it can, and settles what it cannot. On the first boot of this release the node re-reads the chain for the two proofs it accepts — the recorded transaction hash found in a committed block, or the signer's committed nonce having reached the fenced allocation — on the same retry schedule the live reconciler uses, and lifts the fence the moment either exists. For the shape no proof can ever settle (the transaction never committed, and the bytes died with the process that sent them) the node resolves the fence itself once the evidence is unambiguous: it is caught up, it has seen no peer this run, nothing is queued in its mempool, the recorded hash is in no block, and the allocation is unspent. That decision is recorded as a fence_abandoned event with mode=automatic_unprovable and the full evidence, and the abandoned nonce is reserved so the next transaction cannot reuse it. A node that has talked to a peer keeps its fence — there the transaction can still come back, and only a proof or an operator may lift it.

The restart veto now asks the right question. It used to refuse any coordinated restart while a fence was held, on the reasoning that a restart discards the only record of a possibly in-flight transaction. Since durable intent landed, that record is on disk and is re-raised at the next start, so the veto now refuses only when it cannot confirm the record survives (an unwired, unreadable or missing intent row — it fails closed). Refusing blanket-wide was itself the bug: a fenced node would not take the restart that installs the release carrying the fence's own proof reader and recovery.

A fenced write is refused immediately instead of hanging. The lease's fence wait blocks until the caller's deadline, so an agent writing to a fenced node saw a bare timeout. Request-serving paths now check first and answer 503 with Retry-After, naming the transaction the key is held on and stating that nothing was signed or sent.

Already stuck on v11.23.2? Replace the app. A node that is fenced right now refuses the in-app restart that would install this release, so the recovery is the app itself: drag the new SAGE into Applications, replacing the old copy, then quit and reopen it. The first boot of v11.23.3 resolves the fence on the evidence above and writes work again — no terminal, no command to run. The proof route (POST /v1/dashboard/signer-fence/lift) still exists for anyone whose key can be proven, and the operator abandon route remains for fleets that keep their fence because they have peers.

No consensus change, no transaction-type change, no upgrade height, and no chain reset: this decides when a key may sign again, not what the chain accepts.

Container: ghcr.io/l33tdawg/sage:11.23.2. SDK 11.23.2.

What's New in v11.23.2

A chain whose public corpus predates app-v28 can open the fork. The public-memory stage is built by BuildPublicMemoryMigration, which refused to produce a leaf for any PUBLIC=0 record it could not canonically encode — and a real chain carried 53 legacy records whose canonical content hash had been erased by a historical lifecycle transition. Because the stage is prepared outside the consensus transaction, that refusal aborted the activation block on every replay: CometBFT re-entered "replay last block using real app" and the node could not start at all, so upgrade cancel could not help either — it is itself a consensus transaction. Those records are now quarantined out of the committed public set instead of failing the build, exactly as the co-commit tombstone index already treats a record whose decoded hash is not 32 bytes, and a record joins the set in the block that re-anchors its hash.

Narrow by design. Only a record accepted before app-v25 lacks a submission-height marker, and only those could have had their hash erased by a legacy lifecycle transition, so a missing hash on a record born under app-v25 or later is still a hard inconsistency that refuses the build. Nothing about the commitment itself changes: this decides whether an activation succeeds, not what the fork commits.

No transaction-type change, no upgrade height, and no chain reset.

Container: ghcr.io/l33tdawg/sage:11.23.2. SDK 11.23.2.

What's New in v11.23.1

An amid-only fleet can set an agent's enrollment clearance. A validator fleet with no CEREBRUM SPA could not raise an existing agent's clearance: the only producer of TxTypeAgentRoleChange is the dashboard policy route, the legacy PATCH route is retired post-app-v23, and amid served neither. amid now mounts exactly two dashboard routes on its own REST listener — GET /v1/dashboard/network/access and PUT /v1/dashboard/network/access/agents/{id}/policy — with the same handlers and the same operator gate CEREBRUM serves, so the transaction is identical. The caller signs the exact request as the current Root; the node's configured broker key (--cerebrum-root-key-file / SAGE_CEREBRUM_ROOT_KEY_FILE) is that credential, and a node without it answers root_key_unavailable instead of degrading open.

Enrollment clearance is the one the memory-write gate reads. Membership clearance is a different record and never satisfies the gate that compares a submission's classification against the agent's enrollment clearance; this is the surface that writes it, with the role and enrollment revisions the read route exposes.

No transaction-type change, no consensus change, and no chain reset. A patch release inside the 11.23 line: the shipped native shell already admits v11.23 daemons, so no shell range moves.

Container: ghcr.io/l33tdawg/sage:11.23.1. SDK 11.23.1.

What's New in v11.23.0

App-v28 activates. maxSupportedAppVersion moves 27 → 28 and converges with the compiled ceiling, so the gate v11.22.0 shipped dormant becomes an automatic rung: a personal node now advances its own chain across the seam on upgrade with no governance ceremony, the same path every earlier rung took. What activates is the sparse public-memory Merkle commitment over committed PUBLIC=0 records — AppHash-covered through a composite rule that hashes the legacy tree without the index nodes and composes it with the index root — and the co-commit tombstone rule, now enforced by the consensus path behind a content-hash reverse index maintained by every memory write and backfilled at activation.

The state-sync item that blocked it is fixed, and the contract's evidence is complete. A v28 provider used to die on its state-sync serving boot: the verification family recomputed the pre-v28 AppHash rule unconditionally, so the composite root could never match, the process exited with persisted AppHash does not match Badger state, and the caller waited on a Comet RPC that never became ready. The rule is now selected in one function shared by the commit path and the verification path, so the two cannot disagree about which rule is in force. TestAppHashDeterminism_AppV28Activation walks a fresh four-validator devnet app-v2 → app-v28 one rung at a time with byte-identical AppHash at H-1/H/H+1 of every seam; both Consensus Fault Gates pass on this change; and the real-process state-sync gate drives its provider through app-v28 (TARGET_APP_VERSION=28), so a pristine receiver restores from the provider snapshot and both sides report exact app-v28 state with converging AppHash. The gate's receiver pre-publication SIGKILL and provider SIGKILL phases, plus the replay family that pins historical blocks to their original app versions, cover restart and replay equivalence across H.

The native shell rides this release. A minor bump is the release that widens the shipped shell's SSCP compatibility range, which now admits v11.23 daemons — so fixes after this one ship as patch releases under the same shell.

No chain reset and no transaction-type change; historical blocks keep replaying under their original app versions.

Container: ghcr.io/l33tdawg/sage:11.23.0. SDK 11.23.0.

What's New in v11.22.1

App-v28 stays dormant in this release. v11.22.0 shipped the public-memory commitment and the consensus-side co-commit tombstone rule as one compiled gate, with the auto-vote ceiling deliberately held at 27 until its evidence existed. That evidence is nearly complete — the four-validator determinism ladder crosses every seam to app-v28 with byte-identical AppHash, and the upgrade gate drives the whole ladder with auto-votes — but the contract's last item, a promoted node surviving state-sync and restore, currently fails: a v28 node restarted by the real-process state-sync gate comes back, serves, and then stops answering. The ceiling bump ships in the release that turns that green, so app-v27 remains the ceiling here and the deliberate path (propose plus explicit votes) is unchanged.

The Federation page now leads with your connections. Managing a link used to mean scrolling past a status rail, the master switch, a network-name editor, a connectome for every agent, an always-open pairing wizard and only then the connections themselves, and per-agent discovery hid behind a Save button inside an expanded panel. The page opens on Your trusted SAGEs instead. Each connection row states its own discovery posture — all agents visible, N agents visible, or no agents visible — from one bounded read per link, so the row answers without expanding. The connectome and sharing groups move into collapsed Explore agents and Sharing groups sections at the bottom, and the pairing wizard appears only when there are no connections or when Connect a SAGE is used.

Agent visibility is a switch, not a form. Every eligible agent on a connection's roster carries a Visible/Not-visible switch that saves immediately under the connection's revision-bound agreement. The switch works on the full roster, so hidden agents never vanish from the operator's list, and Show all agents / Hide all agents move the whole roster at once. The Save-then-Saved form is gone, and copy-address is demoted to a quiet secondary action on peer cards.

The SDK can set an agent's enrollment clearance. set_agent_access_policy(agent_id, role, profile, clearance, capabilities=0, home_domain=None) writes the atomic app-v23 policy endpoint, and get_access_state() reads the consensus-authoritative snapshot back, so a script verifies the write landed instead of inferring it. This closes a gap that reads as a bug: the memory-write gate compares a submission's classification against the agent's enrollment clearance, not its organization or department membership clearance, so an operator who granted clearance through membership saw every classification ≥ 2 write refused while get_profile() still reported clearance 1.

CEREBRUM's App version panel renders on every node. The panel (chain rung, both ceilings, the Propose button) was nested behind the governance-scope list, so it never rendered on a personal node — scope records only exist once a scope_action commits, and most nodes have none. It now renders on its own, and only the scope cards stay gated.

No consensus change and no chain reset. maxSupportedAppVersion stays 27.

Container: ghcr.io/l33tdawg/sage:11.22.1. SDK 11.22.1.

What's New in v11.22.0

App-v28 ships compiled and dormant, on purpose. Two consensus-visible changes now exist behind one gate. The sparse public-memory Merkle index over committed PUBLIC=0 records becomes AppHash-covered at the activation height, through a composite rule that hashes the legacy tree without the index nodes and composes it with the index root. The co-commit tombstone rule stops being a check at the local REST submission boundary and becomes a rule the consensus path enforces. Neither one is active: maxSupportedAppVersion stays 27, so every node's upgrade auto-voter abstains on v28 and a personal node cannot advance itself into the fork. Activation waits for the evidence the contract names — byte-identical AppHash across the seam on a four-validator devnet, both Consensus Fault Gates, a promoted node surviving state-sync and restore, and replay equivalence — and ships in the release that carries it. An explicitly proposed, quorum-approved plan can still activate it; nothing does so on its own.

The tombstone rule is a consensus rule now. A co-commit never consults the voter — block inclusion is decisive — so the content-hash dedup that keeps a rejected memory's exact bytes out of the store never ran on that path, and a directly broadcast envelope never met the REST guard at all. The predicate needs data consensus state did not carry: memory:<id> is a content hash plus status, so "did these exact bytes already leave proposed under a different id" had no reverse lookup. The fork adds one — an entry per content hash and id that has left proposed — maintained by every memory write, backfilled from existing records at activation, and consulted from H+1 with the candidate's own id excluded so an idempotent re-send is decided by its own record.

The binary now states two ceilings instead of one. What it can execute (app-v28, compiled) and what it will auto-vote (app-v27) are different numbers while a gate awaits its evidence, and the surfaces say which is which: upgrade status and upgrade preflight print both, the version banner and full-backup stamp follow the compiled ceiling, and state sync accepts a restore up to it, so a promoted node can be rebuilt from a snapshot. The acceptance gate and the authorization ceiling moved with them, and the invariant that used to require all three numbers to be equal now states what each one means.

Upgrades can be proposed and voted on from CEREBRUM, and voted on from the terminal. The Governance view gains an App version panel — the chain's rung, both ceilings, the pending plan, the active ballot, a Propose button for the next rung — and sage-gui upgrade vote casts an explicit accept, reject or abstain. That path matters because a dormant gate is designed so nothing auto-votes: reaching quorum is a deliberate act by validators, which is what the panel and the command exist for. The generic governance-propose route still refuses OpUpgrade by design; the dashboard speaks the dedicated UpgradePropose transaction instead.

No chain reset, no transaction-type change, and historical blocks keep replaying under their original app versions. app-v27 remains the ceiling until v11.22.0's dormant gate gets its evidence.

Container: ghcr.io/l33tdawg/sage:11.22.0. SDK 11.22.0.

What's New in v11.21.0

The 11.21 line opens, and the shell that admits it ships with it. The daemon is the v11.20.5 build: a peer whose address moved repairs its own route, a flapping peer's windows are spent on the backlog, and recall names the confidence floor that filtered a result instead of returning an empty answer. What is new is the line itself. The SSCP compatibility range lives in the shipped native shell, not in the daemon, so a minor bump is the release that has to widen it: the shell now accepts v11.10 through v11.21 daemons, which is what lets the fixes after this one ship as patch releases instead of a rebuilt shell each time. If you run the daemon and the desktop app as separate installs, update both — an 11.21 daemon under the 11.20.5 shell is refused control by design, and that refusal is the gate doing its job rather than a fault.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.21.0. SDK 11.21.0.

What's New in v11.20.5

A peer whose address moved repairs itself instead of waiting for a human. The R2 fix let a P2P-only agreement run the authenticated route exchange across trust generations, because withholding the route fallback left it no transport at all. The same assumption fails for an agreement paired with a concrete endpoint once that host moves: the address is real, so nothing looks unroutable, but every request dials a machine that no longer answers while the peer's own traffic keeps arriving — the asymmetry operators report as "they can reach us, we cannot reach them". Withholding the fallback there also blocked the exchange, which is the only thing that can replace the stale snapshot, so the pair could never recover without re-pairing. The exemption is now about the path rather than the agreement shape: the exchange may use a stale snapshot as an authenticated bootstrap hint for both, while every other request still refuses a cross-generation route, and the persisted result is revalidated against the exact agreement and binding before it is written. A moved host also no longer reads as an offline one: the failure carries the trust-generation recovery code, so the operator's next move is a route repair rather than a network investigation.

A window of reachability is spent on the backlog, not on one message. A peer that flaps hands out short windows, and the drain only attempts rows whose backoff has expired — so a fresh event, due immediately on its first attempt, consumed the window while older rows slept through it. That is exactly the shape of a message created at 21:15 delivering while messages from 21:10 and 21:11 stayed queued. A successful delivery now proves the peer reachable and makes the rest of that peer's backlog due at once (attempt counts and last errors untouched — only the sleep is cleared), and a drain pass covers sixteen rows rather than four, with concurrency unchanged.

Recall no longer hides results behind the confidence floor without saying so. A memory reachable by tag was invisible to semantic recall because the node's floor (85) sat above the confidence its records were written with (0.80): the floor is applied before ranking, so no query can compensate, and the response said nothing — the whole observation tier is unreachable on a node tuned that way. Recall now reports the floor it ran with, how many candidates the floor removed, and a one-line note naming the remedy and the tiers a floor above 0.80 or 0.60 hides; the REST envelope carries the same facts under filtered and the X-SAGE-Filter-Applied header, and the settings surface warns where the value is read and saved. A floor that removed nothing is disclosed too, because that is what lets an empty result be trusted.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.5. SDK 11.20.5.

What's New in v11.20.4

A signer fence now survives the process that raised it. The fence is in-process state, and its own documentation named the hole: a restart, crash or SIGKILL discarded it, after which the nonce allocator re-seeded each key from the highest committed nonce — below the abandoned one by definition, because "unresolved" is what unresolved means — and the next action signed into that gap. The abandoned transaction was refused Code 4 when it finally landed, and the loss was untraceable: an operator saw an unrelated later action fail as a replay. Every submission is now shadowed by a durable record written at the last boundary before the bytes reach the transport, retired only on a proven fate, and re-raised as a fence at startup — so a node that was killed mid-submission comes back refusing to sign that key instead of re-seeding past it. Measured against a real cluster: two validators held fences for 13 days while their transaction sat in neither chain nor mempool, and their restarts bought exactly one signature each because the discarded fence was the only record of it.

A nonce that is provably dead now has an exit. The fence's rule is that only proven fate lifts it, which left one shape it could not resolve on its own: a submission whose fate was never observed and whose signed bytes did not survive the process. POST /v1/dashboard/signer-fence/lift (behind the CEREBRUM operator gate) accepts two proofs and nothing weaker — the exact transaction found in a committed block, or supersession, meaning a higher nonce for that signer has already committed, which makes the fenced allocation permanently uncommittable under the consensus nonce rule. Both proofs are read by the node rather than asserted by the caller, and a superseded lift records that the fenced transaction's payload is permanently lost. A lookup miss stays unproven: CometBFT indexes a transaction only once it is in a block, so a mempool-resident transaction answers not-found exactly as it does one second before it commits.

What the record deliberately does not carry. Not the signed bytes. Those routinely hold memory content that must not be copied into a plaintext table, so a restored fence resolves by proven fate instead of by re-submission. And a crash between the record and the wire holds a key that may have nothing in flight — the safe direction, resolved through the same proof path.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.4. SDK 11.20.4.

What's New in v11.20.3

A peer's "too large" answer no longer kills the message. The federated outbox classified 413 alongside the 4xx statuses that mean the peer understood the request and refused the bytes, so a single refusal marked the transport event failed and the canonical message with it: the row is never scanned again, and a durable-until-handled message carries an expiry a century out that never relieves it. That verdict is wrong for this status. A peer's per-route body cap is a build-time constant that moves when the peer upgrades, and the refusal is frequently not about size at all — on 2026-09-15 a message was refused as too large while its signed body sat 2.6 KB under the route's 16 KiB cap, and a larger message to the same peer was accepted unchanged minutes later. 413 now retries on an hourly floor, like the other capability-shaped status, so the event stays pending and delivers once the peer can take it.

The listener stopped calling every body it could not read "too large". The federation gate read the request body and answered 413 for any error, which merged a genuine over-cap body with a truncated upload, a mid-body disconnect and a stream reset — and the sender's terminal 413 rule turned that mislabel into permanent loss. Only a real *http.MaxBytesError is 413 now; a body this node could not read is answered as a read failure, which stays retryable, and logged with its underlying cause.

A delivery failure is visible in the log. The transport worker logged only when recording a failure failed, so an event could die with nothing in the log to say why. Every failed attempt now carries the event, the peer, the kind, the attempt count, the verdict and the retry delay.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.3. SDK 11.20.3.

What's New in v11.20.2

A submission whose outcome the node could not observe is now reported as exactly that, instead of as a failure. Every REST submit waits for broadcast_tx_commit, and that wait can expire before the block lands — on a loaded cluster the transaction then commits seconds later, while the caller has already been told 500 Broadcast error, indistinguishable from a genuine internal fault. That was worse than unhelpful: a caller retrying "on error" re-signs, so one write can be applied twice. The endpoint now answers 202 with "status":"indeterminate", the exact tx_hash of the bytes that went on the wire, the allocated nonce, and "retryable":false, while the node's signer nonce fence keeps reconciling the real fate.

Definitive outcomes keep their verdicts. A CheckTx or FinalizeBlock rejection still returns the status it always did, and a full mempool still returns 429 with Retry-After — nothing was admitted, so there is nothing in flight to chase.

Generated testnets stop inheriting the wait that causes it. deploy/init-testnet.sh now writes timeout_broadcast_tx_commit explicitly (45s) rather than leaving CometBFT's 10s default, and keeps it strictly below SAGE's own client-side wait (SAGE_TX_COMMIT_TIMEOUT_MS, 60s) so the node — which knows whether it admitted the bytes and can name the transaction hash — is always the party that answers.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.2. SDK 11.20.2.

What's New in v11.20.1

Federated replies are deliverable for a week, not a day. The window a reply stays admissible, and the deadline its retained outbox event is retried until, move from 24 hours to seven days (federation.PipeEventResultLifetime). A destination re-derives that window from the signed proof, still admits the legacy 24-hour window, and a destination that predates the longer one is answered by one downgraded retry at the old window instead of a terminal failure — so replies keep flowing while peers upgrade at their own pace. Receipt evidence about a message keeps its own separate 24-hour grace.

Replies can no longer be permanently lost to a local retention re-stamp. The startup migration that extends durable canonical sends matched every pending msg-% outbox row, including the receiver-local msg-fed-… id of an imported message — whose outbox row is a reply. It re-stamped those replies to a +100-year lifetime, which the destination refuses as an invalid proof, and because the same column is the retry deadline it also removed the give-up path, so the reply retried until it happened to reach the peer and collect the permanent 400. The rescue is now scoped to sends, stamps the exact durable sentinel (+36500 days, not SQLite's calendar +100 years), repairs rows an earlier build already extended, and reply envelopes are built from the signed proof so local retention state can never reach the wire.

A refused proof now says why. The destination logged nothing when it refused a proof, and the sender only recorded the destination's single opaque invalid pipeline agent proof refusal, which is how ten historical reply failures stayed unattributable. The destination now logs the exact reason and the sender checks its own reply envelope against that same rule before pushing.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.1. SDK 11.20.1.

What's New in v11.20.0

An agent's working state can now be stored encrypted on the node. Two new surfaces are reachable only from inside the app-v23 pipeline agent boundary, and both refuse to run without the Synaptic Ledger vault: PUT/GET /v1/private-media/{uuid} stores immutable JPEG originals with ciphertext-only rows, per-caller actor isolation, quota enforcement and a startup disk-floor probe, and PUT/GET /v1/workflows[/{uuid}] gives an agent an encrypted, actor-bound journal for long-running work with compare-and-swap revisions, strict argument bounds and an opt-out conversation guard. Neither surface can be reached for another agent's rows, and neither writes a plaintext copy to the database or its WAL.

You can now prove whether message storage is encrypted. GET /v1/messages/storage reports the honest storage posture of this node, and POST /v1/messages accepts a strict signed require_encrypted_storage boolean: an agent that must not be stored in the clear now gets a 503 instead of a silent downgrade, and a malformed or unsigned value is rejected rather than ignored. The authenticated request-body limit became route-aware for exactly one route: a canonical-UUID private-media PUT gets one extra MiB, everything else keeps the 1 MiB ceiling.

Local durability is no longer taken on faith. SQLite opens with synchronous=FULL in both DSN and PRAGMA form and the node verifies journal_mode and synchronous at boot, refusing to serve when the durability posture is not provable. Vault publication is atomic in the same vein: attaching a vault and marking encryption required can no longer be observed separately, so an unlock cannot leave a window where a write is accepted against a store that does not yet require encryption.

Managed appliance bring-up, with no product names in core. sage-gui init-fresh-personal-sage --profile <path> --unit <id> --owner-approved-companion-bootstrap creates a fresh-only personal identity from a root-owned, mode-0600 provisioning profile. It refuses an existing or mismatched node rather than reusing it, takes its companion-key bootstrap explicitly, and never installs services or enables public enrollment. A profile that sets private_listeners: true makes a missing config an explicit error rather than a default, and the policy is re-checked when the YAML is loaded so an edit cannot silently weaken it. The product that ships a profile owns its home path, Unix account, unit ids and artifact filenames; SAGE core knows none of them.

A public-memory Merkle index ships dormant, and no fork is opened. The sparse SHA-256 index over committed PUBLIC=0 records, its migration builder and its stage/promote path are in the tree with their tests, and no production code calls any of them. Staged rows live under a local namespace that is excluded from the AppHash; promotion is what writes into AppHash-covered state, it is explicitly named for app-v28, and it is not reachable from a running node. Read that as preparation, not as activation.

Federation: you decide which of your agents the other side can find. A trusted link advertised every eligible ordinary agent to the peer, which is convenient with one agent and confusing with a dozen — the other operator sees names they do not recognise and sends work to the wrong one. Each connection now carries an explicit discovery policy: All agents (the default), Only the ones I pick, or None. Ticking one agent narrows the connection to exactly that agent, ticking more adds them, and Save discovery policy commits it under the same revision-bound agreement the rest of federation uses. It governs listing and exact-name search only: it grants no memory Read and authorises no delivery, and an agent that still refuses federated delivery stays visible as Not accepting by design so the peer is never promised a route it cannot use.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.20.0. SDK 11.20.0.

What's New in v11.19.22

The Go build floor moves to patched 1.26.8. Both modules now declare go 1.26.8, up from 1.25.13, and every Go container builder moved with them: Dockerfile, deploy/Dockerfile.abci, deploy/Dockerfile.node, both federation-acceptance Dockerfiles and deploy/init-testnet.sh. Building from source now requires Go 1.26.8 or later.

This is not a fix for a hole you have. v11.19.21 and everything before it were built with Go 1.25.13, and that toolchain scans clean on its own standard library. It is a deliberate move forward: the dependency group below requires Go 1.26, and the bare 1.26.0 those tools would otherwise have pinned is precisely the version govulncheck reports 26 reachable standard-library advisories against — among them net/url (GO-2026-6218), html/template (GO-2026-6091), crypto/tls (GO-2026-6090, GO-2026-5856), net/http (GO-2026-6089, GO-2026-5026), encoding/xml (GO-2026-6088), encoding/asn1 (GO-2026-5972), net/textproto (GO-2026-5039) and crypto/x509 (GO-2026-5037). 1.26.6 is the minimum fix for those; 1.26.8 is the newest patch of the line, and on it the vulnerability gate reports no reachable vulnerabilities in either module.

Dependencies refreshed. github.com/jackc/pgx/v5 v5.11.0, github.com/klauspost/compress v1.20.0, golang.org/x/crypto v0.57.0, golang.org/x/sync v0.23.0, golang.org/x/sys v0.48.0, golang.org/x/tools v0.50.0 and modernc.org/sqlite v1.58.0, plus the x/net, x/mod, x/text and x/telemetry indirects. The SQLite driver moves to SQLite 3.53.4, which carries upstream's own journal-rollback fix — the reason the local super-journal patch existed — so that patch retires with no change to recovery behaviour. The pgx bump adds TypeMap to the pgx.Rows interface, so the store tests move from pgxmock/v4 to pgxmock/v5; that is a test-only import change with no runtime effect.

Also in this release: golang.org/x/crypto still carries GO-2026-5932 at v0.57.0, its newest release. It is in the module graph and is not reachable from SAGE code; the gate reports it as uncalled rather than failing.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.22. SDK 11.19.22.

What's New in v11.19.21

A co-commit can no longer re-commit bytes the quorum already rejected. A co-commit commits on block inclusion and never runs the voter, so the content-hash dedup that keeps a rejected memory's exact bytes out was skipped on that one write path: a jointly-signed envelope could re-admit content that had been deprecated, under a fresh memory id, while the same bytes submitted through POST /v1/memory/submit were refused as a duplicate. POST /v1/cocommit/submit now consults the same lookup before it broadcasts and refuses a tombstoned hash with 409 Tombstoned content; the envelope's own SharedID is excluded so an idempotent re-send still works. It is a submission-boundary check rather than a consensus rule — the consensus path deliberately reads no off-chain state — so a node that broadcasts a co-commit transaction directly, bypassing its own REST surface, is not covered by it.

The MCP client stopped keeping its own duplicate rule. sage_remember, sage_observe and sage_reflect used to drop a write when more than 60% of its significant words appeared inside one of the first 50 committed memories in the domain — silently, order-dependently, and only on MCP, so the same write over REST or the SDK landed. They now report the node's own verdict: POST /v1/memory/pre-validate runs the same dedup, quality and consistency checks the vote applies, an exact duplicate comes back as status: "skipped" carrying the node's reason, and a memory that merely shares vocabulary with an existing one is stored instead of discarded.

Also in this release: the validated status is documented as declared-but-unwritten (nothing has ever produced it, and recall would hide such a row), an unused ValidateMemoryRecord that duplicated the REST validator is gone, and the reference docs state plainly that knowledge triples and access_logs are write-only.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.21. SDK 11.19.21.

What's New in v11.19.20

Dedup rejection is sticky. Content that was rejected, challenged, or forgotten can no longer be re-admitted by submitting the identical bytes again: the voter's dedup lookup now matches any other memory that has left proposed, not just committed ones, while a candidate can never match its own row (the v10.1 self-match fix stays fixed). Two identical submissions racing each other no longer veto each other, and a correction still passes whenever its content actually changed.

The dedup lookup — evaluated once per pending memory on the voter's two-second poll — is now indexed on both stores. SQLite gains a content_hash index; Postgres drops its legacy committed-only partial index at startup and rebuilds once, which can make the first boot after upgrade slower on a large memories table.

Also in this release: the README, the sage-memory skill, and the reference docs qualify the BFT/consensus claims for single-validator personal installs, and the papers section now cites the true published provenance.

No consensus change or chain migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.20. SDK 11.19.20.

What's New in v11.19.19

Security dependency update: upgrades gRPC-Go from v1.83.1 to v1.83.2, addressing CVE-2026-84445 / GHSA-2v4p-qf9q-27wj. The upstream fix rejects HTTP/2 requests missing both :authority and Host headers, preventing a panic in xDS servers. SAGE's CometBFT servers use ordinary gRPC servers, but the dependency is patched for defense in depth.

No consensus or storage migration; app-v27 remains the ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.19. SDK 11.19.19.

What's New in v11.19.18

Federation agents now visibly orbit their nodes. Motion continues over empty map space and resumes after pointer selection; hovering an agent, keyboard inspection, and dragging keep targets steady. Pause motion and reduced-motion preferences remain supported.

Container: ghcr.io/l33tdawg/sage:11.19.18. SDK 11.19.18.

What's New in v11.19.17

See your federation. CEREBRUM opens connected nodes as an interactive connectome with agent clusters, search, zoom, a List view, and a selection panel for exact addresses and connection controls. Gentle ambient agent drift includes a pause toggle, stops during interaction, and respects reduced-motion settings. Actual node names make the viewed node clear, including when you open another SAGE through a tunnel.

A dedicated operator-only SSE stream shows recent message and reply transport status without exposing message text or proofs. Live changes animate when their endpoints are loaded; reconnecting refreshes history without replaying old traffic. The view is bounded, with explicit agent and node paging.

Federation onboarding now explains Exchange codes → Verify together → Explore agents. Both confirmation screens preserve the explicit number check and explain that memory sharing is optional. Read, Copy, and Clear domain permissions accept bulk selection or drag-and-drop into a draft, with an explicit save. Removing trust keeps its separate confirmation and pairing-again explanation.

No consensus-rule or application-version change; app-v27 remains the ceiling. Existing permissions and trust agreements stay in place. Container: ghcr.io/l33tdawg/sage:11.19.17. SDK 11.19.17.

What's New in v11.19.16

Connect nodes, find agents, send messages. Trusted peers running v11.19.16 make eligible ordinary agents discoverable and messageable automatically, without exporting each agent or granting access to memory domains. Root identities stay excluded, and explicit messaging blocks still apply.

CEREBRUM adds a searchable directory grouped by node, exact-address copying, and paged agent lists. Bulk selection and drag-and-drop prepare Read/Copy sharing choices; saving those choices explicitly grants memory access. Pairing alone shares no memory domains, and existing approved grants remain in place.

MCP sage_directory searches local and federated agents by default. Upgrade both peers for automatic node messaging; older peers retain their export-based behavior. New sends refresh legacy recipient tickets, while queued messages retain their original authorization mode.

Federated replies now accept the signed claimant-session field emitted by MCP, fixing peer rejection of otherwise valid replies. Reply retries report the actual retained delivery state and diagnostic instead of always claiming "queued". Existing failed events remain failed; the upgrade does not silently resend them.

No consensus-rule or application-version change; app-v27 remains the ceiling. Container: ghcr.io/l33tdawg/sage:11.19.16. SDK 11.19.16.

What's New in v11.19.15

Consensus-safe memory cleanup, without the 500-record cap. CEREBRUM now scans the full inventory, previews verified eligible counts, and processes manual or automatic cleanup through existing consensus challenge transactions. Open tasks and internal records are protected. The UI distinguishes queued work, confirmed submissions, and observed outcomes instead of reporting premature success.

Automatic cleanup requires fresh current-Root authorization after upgrading; old enabled toggles do not silently activate it. Preview does not enable cleanup. Exact signed transactions are saved before submission for safe recovery. A challenge may need further votes; audit history is retained. See the cleanup guide.

No consensus-rule or application-version change; app-v27 remains the ceiling. Container: ghcr.io/l33tdawg/sage:11.19.15. SDK 11.19.15.

What's New in v11.19.14

Security dependency update: gRPC-Go is upgraded to v1.83.1 to address HTTP/2 DATA-frame fragmentation heap exhaustion (CVE-2026-84304, Dependabot alert #45). The required genproto and OpenTelemetry dependencies are refreshed alongside it. CodeQL workflow actions are pinned to the verified v4.37.9 commit.

This patch introduces no consensus-rule, AppHash-input, key-encoding, fork-target, or application-version changes. App-v27 remains the supported ceiling.

Container: ghcr.io/l33tdawg/sage:11.19.14. SDK 11.19.14.

What's New in v11.19.13

The stdio MCP bridge no longer self-installs project hooks into the user’s home directory. When sage-gui mcp starts with $HOME as its working directory, automatic project repair now returns without writing .claude hooks or project-relative hook registrations into user-global configuration.

Explicit sage-gui mcp install and sage-gui codex install commands keep their existing home-directory refusal. Normal project-directory self-healing also remains unchanged, including when CLAUDE_CONFIG_DIR points elsewhere.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.13. SDK 11.19.13.

</details>

Release History

The latest release notes are above. Earlier entries below describe behavior at their release dates; use the current reference for present-day contracts.

<details> <summary>Earlier releases — preserved changelog</summary>

What's New in v11.19.12

Project-scoped MCP and Codex installs can no longer corrupt user-global host configuration. sage-gui mcp install and sage-gui codex install now refuse to run when the working directory resolves to the user's home directory. Run the command from the intended project instead; ordinary project installs are unchanged.

The native-shell build also refreshes its fail-closed checksum for the official September linuxdeploy-plugin-appimage rebuild. The replacement was produced by the upstream project's successful scheduled workflow from its unchanged source commit, and its downloaded SHA-256 matches GitHub's release-asset digest. An unexpected future replacement will continue to stop the build.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.12. SDK 11.19.12.

What's New in v11.19.11

CEREBRUM now supports operator-configured hostnames behind a local TLS reverse proxy. Set SAGE_ALLOWED_CEREBRUM_HOSTS to an exact comma-separated hostname allowlist when Caddy, Traefik, or another loopback proxy preserves the browser-facing Host instead of rewriting it to localhost. Ports are normalized and wildcards are deliberately unsupported.

The trust boundary stays local: the connected peer and every forwarded IP hop must still be loopback, unconfigured hostnames still fail closed, and browser origin matching accepts X-Forwarded-Proto only when every field-line and comma-joined token is a valid, case-insensitive http or https value and all hops agree. Empty, malformed, or mixed scheme chains are rejected.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.11. SDK 11.19.11.

What's New in v11.19.10

Returning agents can be reviewed normally again. When app-v26 retirement has handed an agent's former home domain to the stable Root principal, CEREBRUM reapproval now binds the existing owner and uses the established Root-to-agent recovery transfer for that exact recorded home. Fresh or operator-entered domains never receive an implicit transfer.

Rejecting a pending registration now counts active memories—the same lifecycle view shown by the recovery panel—instead of treating deprecated audit history as work the operator can still remediate. Active records continue to block ordinary rejection unless they are deprecated, transferred, or the explicit attribution-preserving force path is chosen.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.10. SDK 11.19.10.

What's New in v11.19.9

Codex workspace identity resolution now fails closed at the filesystem root. A user-level Codex MCP process launched from / can no longer reuse the retired global-codex signer or auto-register the synthetic name codex//. SAGE rejects that broad, untrustworthy boundary before Git discovery, project-config lookup, key loading, or key generation. Real project and linked worktree roots continue to resolve to their stable workspace identities; operators who intentionally need a non-workspace shared identity must pin it explicitly with SAGE_IDENTITY_PATH.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.9. SDK 11.19.9.

What's New in v11.19.8

Access Groups now discover transferred historical domains, not only each member's enrollment-time home domain. CEREBRUM's bounded caller-domain projection consults the consensus-maintained current-owner index for the caller and active local group peers. A transferred user-* domain therefore appears as a usable exact recall or write target even when its current owner never authored a memory there.

Every discovered candidate is still re-authorized against current ownership, group authority, profile restrictions, and hard denies before it is returned. Per-record classification checks remain on the memory disclosure path. The result remains bounded and explicitly reports truncation; it does not expose a global domain roster, change ownership, copy grants, or weaken shared-domain and foreign-write restrictions.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.8. SDK 11.19.8.

What's New in v11.19.5

Claim recovery and host wake coordination now survive real multi-transport runtimes. Both exact-local compatibility claim paths—GET /v1/pipe/inbox and explicit PUT /v1/pipe/{pipe_id}/claim—atomically bind the session and create its receipt, so ownership cannot commit without recovery evidence. MCP claimant identities are durable and transport-scoped across stdio, Streamable HTTP, and SSE; claimant_identity_mode discloses whether the identity is durable, a safe concurrent ephemeral fallback, inherited, or unavailable.

Claim transfer remains deliberate. sage_message_handoff requires the exact claimant_session_id and claim_revision returned by passive history; stale or A→B→A delayed transfers fail the revisioned compare-and-swap fence. The direct REST route preserves pre-v11.19.5 clients by treating an omitted from_revision as 0 only, so it can move an untouched first-generation claim but safely conflicts after any transfer. SAGE never steals a claim merely because it is old.

The new signed, payload-free GET /v1/inbox/activity-state returns exactly {version,epoch,seq} so host hooks can notice fresh task assignments and replies. The opaque 32-character database-incarnation epoch survives process restarts and backup restore, but changes for a fresh database so an old host cursor cannot suppress new cues after reinitialization. Those events remain nonblocking coordination: they do not change the exact three-field {version,seq,pending} contract of /v1/messages/wake or /v1/messages/wake-state, and they never make Stop treat a reply as unfinished work. Hooks can surface activity on the next prompt, but cannot resurrect an already-idle host task.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.5. SDK 11.19.5.

What's New in v11.19.4

Updater governance compatibility and recovery state are now one atomic proof. The replacement binary reports its own maximum supported application version. SAGE validates canonical pending-plan and active-ballot state against that exact ceiling while holding the same runtime read fence that pins the snapshot height and AppHash. Consensus cannot publish newer governance state between the compatibility decision and the verified recovery snapshot.

v11.19.3 acquired those two read fences separately. Its snapshot was coherent, but a concurrent Commit could make the preceding compatibility verdict stale. Personal single-node installs still upgrade normally in the app: v11.19.3 and v11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create an unsupported app-v28 transition, and the updater performs the recovery snapshot, coordinated stop, final stopped-state snapshot, install, rollback, and restart automatically. No CLI or manual preflight is required. The stopped-node procedure in docs/UPGRADING.md is only for quorum or externally managed nodes where an operator can mutate governance during the v11.19.3 check-to-fence window.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.4. SDK 11.19.4.

What's New in v11.19.3

Normal upgrades now preserve compatible governance state automatically. The desktop updater reads the canonical pending plan and active proposal under one runtime-consistent view before changing the executable. A supported in-flight upgrade is included in the existing verified recovery snapshot and continues after restart; it is not a reason to interrupt the user or block the update. No terminal command, preflight ceremony, or governance expertise is required.

Malformed canonical state, an undecodable upgrade ballot, or a target newer than this binary supports still fails closed before executable mutation. The technical upgrade status and stopped-node upgrade preflight commands remain available for headless and quorum operators. Superseded safety notice: the v11.19.3 live updater did not hold one uninterrupted fence across that check and snapshot capture. That does not impose a CLI step on a personal node; only quorum or externally managed governance needs the coordinated stopped-node procedure when leaving v11.19.3.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.3. SDK 11.19.3.

What's New in v11.19.2

Binary replacement now has consensus-authoritative upgrade-governance proof. The read-only /upgrade/governance-status ABCI query reports the current application version, the exact pending upgrade:plan record, and the canonical state:gov:active proposal. Upgrade ballots include their decoded target application version. Storage, pointer/proposal identity, bounds, canonical-name, status, height, and payload-decode failures return ABCI code 1 instead of being misreported as an empty plan or ballot.

sage-gui upgrade status now consumes that fail-closed query rather than inferring safety from /abci_info plus the off-chain dashboard projection. The stopped-node sage-gui upgrade preflight command uses the same canonical inspector before the new server starts. v11.19.3 integrates that compatibility decision into the normal updater and lets supported in-flight operations continue automatically.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.2. SDK 11.19.2.

What's New in v11.19.1

Stranded message claims remain recoverable beyond the retained-history window. sage_inbox now embeds the first passive, payload-free page of unfinished claims held by another runtime sharing the same exact agent identity. Agents can continue through every older page with sage_message_history(folder="claimed_elsewhere"), then deliberately transfer an exact claim through the existing compare-and-swap sage_message_handoff path after deciding that its former claimant is dead or stale.

The recovery projection exposes only the message ID, claimant-session fence, timestamps, and local/federated classification needed for safe handoff. It does not expose sender identity, intent, payload, result, provider, or chain IDs. Expired TTL-bounded claims are also excluded consistently from both the exact diagnostic count and its recovery pages before the periodic expiry sweep runs.

Provider-addressed compatibility messages now bind atomically to the exact claiming agent and MCP session, resurface on later polls, support CAS handoff, and complete idempotently through sage_message_reply. A failed reply explicitly does not authorize creating a substitute sage_message_send; agents must recover the original claim or report the failure. Existing claimed provider rows receive an off-chain SQLite legacy session fence during startup migration.

This patch introduces no consensus change or application-version increase. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.1. SDK 11.19.1.

What's New in v11.19.0

Record authors regain lifecycle authority in reserved shared namespaces. After app-v27 activates, the immutable author of a record in general, self, meta, or sage-* may challenge that record and may reinstate its open challenge without separately holding a level-3 Modify grant. The exception is record-scoped and does not apply to governance-promoted shared domains. Pending or inactive enrollment, read-only/profile restrictions, shared-write denies, and classification/clearance failures still deny the action. App-v21 weighted challenge rounds include the eligible record author in their frozen electorate.

Omitted task status now has one canonical meaning. After app-v27, a signed new-task request that omits task_status is canonicalized to planned by both REST transaction construction and consensus proof verification. Pre-app-v27 chains retain the historical requirement to send task_status: "planned" explicitly, preserving replay and AppHash compatibility.

App-v27 is a governed consensus upgrade from app-v26 with no state migration. Its rules begin at H+1 after activation; older blocks replay under their original application version.

Container: ghcr.io/l33tdawg/sage:11.19.0. SDK 11.19.0.

What's New in v11.18.28

Reserved shared domains are readable again without becoming ownable. Active local principals can read the compile-time shared namespaces general, self, meta, and sage-*, while each record's classification still applies. This restores the shared-domain behavior expected by existing agents without opening private or restricted records.

Access-grant transactions now reject attempts to register either those reserved namespaces or governance-promoted shared domains as owned domains. REST reports that conflict as a forbidden request, and the API, SDK, and RBAC references now state the same contract.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.28 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.28. SDK 11.18.28.

What's New in v11.18.27

Empty semantic recall now distinguishes genuine absence from an incomplete vector-space view. For an empty, domain-scoped semantic query, index_status reports complete, incomplete, or fail-closed unavailable only when the caller and exact query universe support that conclusion. The same signal is relayed through sage_recall and sage_turn, so write-on-absence agents can avoid manufacturing duplicates when committed memories are temporarily unreachable in the active embedding space.

The proof is caller-safe and race-fenced across canonical projection, SQL, embedding-space, and vault generations. Narrowed or federated queries and unhealthy projections never receive a false completeness claim, while bounded indexed probes keep the empty-result path operationally safe.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.27 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.27. SDK 11.18.27.

What's New in v11.18.26

The supported Go dependency baseline is refreshed. This release carries the validated testify 1.12.0, x/crypto 0.55.0, and x/tools 0.49.0 module updates already exercised by the full repository gate.

Code scanning and native-shell CI actions are refreshed to their pinned current revisions. CodeQL runs with the updated action bundle and the native shell cache action is updated, without changing SAGE runtime behavior.

HTTP MCP tokens now bind to existing approved managed identities. On app-v23 nodes, token creation no longer generates an unapprovable pending principal: Root/Admin selects an active ordinary agent already managed by the node, and issuance fails closed if its exact key is unavailable. The CLI also handles mcp-token create --help without minting a credential and rejects unknown creation flags.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.26 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.26. SDK 11.18.26.

What's New in v11.18.24

Federated inbox work now has recoverable, session-fenced ownership. SAGE binds an inbound federated claim to the receiving MCP session before exposing its payload. Retained older claims receive an explicit legacy CAS fence for deliberate handoff; live work is never stolen by a timeout. Reply completion, the claimant check, encrypted result fingerprint, and durable return event now commit atomically, so a lost-response retry returns the original event while a different second reply conflicts.

MCP boot guidance no longer rides inside ordinary tool results. Lifecycle standing stays in initialize.instructions, including for a client that initializes after its first tool call. The former imperative block that asked an agent to invoke tools and edit a memory file has been removed, keeping the inbox trust boundary internally consistent.

Embedding-space and retention diagnostics are more precise. The readiness guard labels only a qualified-versus-bare spelling of the same provider/model leaf/dimension as a likely alias, without collapsing two organizations that publish the same basename. Durable-until-handled presentation is limited to actionable pending/claimed work, while mixed-version retention-only responses remain compatible.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.24 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.24. SDK 11.18.24.

What's New in v11.18.23

Turn-time recall now carries the same trust and lifecycle evidence as explicit recall. sage_turn includes each recalled memory's corroboration_count and status, so the every-turn path no longer hides corroboration weight or whether a recalled row is committed or currently challenged.

Embedding-space drift is visible before it silently empties semantic recall. At boot, SAGE compares the active embedder with the non-deprecated vector spaces already in the local store. A mismatch produces a loud warning and a structured embedding_space block in /ready; the node remains available by default while strict readiness returns 503, allowing an intentional re-embed migration to finish instead of turning a quality warning into an outage.

Managed reranker setup now diagnoses incompatible prebuilt engines. After a verified install, SAGE preflights llama-server. Proven GLIBC, GLIBCXX, or CXXABI loader failures preserve the loader's real error and point operators to the bring-your-own reranker path instead of reporting a successful unusable install.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.23 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.23. SDK 11.18.23.

What's New in v11.18.22

A missing optional ForceGraph API can no longer strand CEREBRUM after the verified brain has rendered. The renderer now publishes the core graph and truthful counts before optional anatomical, control, and interaction setup. The bundled runtime's absent clickAfterDrag helper is feature-gated, so the brain hull, controls, and auto-rotation continue instead of falling into the cold unavailable path with real nodes already on screen.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.22 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.22. SDK 11.18.22.

What's New in v11.18.21

A domain-summary refresh can no longer cover a verified MRI graph. The MRI renderer is now the sole authority for the central unavailable overlay. Domain inventory failures stay localized to their own retrying panel, while genuine cold graph failures and unsafe mode switches remain fail-closed.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.21 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.21. SDK 11.18.21.

What's New in v11.18.20

A transient MRI refresh no longer hides a graph CEREBRUM has already verified. Memory and Connectome snapshots now retain their explicit source mode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible only when it belongs to that same mode, while retrying in the background. Cold failures and failed mode switches still fail closed, so Connectome bytes can never masquerade as a verified memory projection.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.20 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.20. SDK 11.18.20.

What's New in v11.18.19

Codex project hooks stay inside their project. The v11.18.18 byte-exact self-healer could mistake Codex's user-global ~/.codex configuration directory for a project and generate a global hooks.json. That made an unrelated Codex task receive SAGE inbox Stop nudges for the shared agent identity. The healer now refuses the user-home/global scope; project-local hooks continue to self-repair.

Connectome clicks now have one hit-tested owner. The redundant DOM click fallback that raced ForceGraph's deferred node click is gone. Small pointer wobble is handled by one explicit tolerance, background dismissal uses the graph's raycast result, and clicking a second neuron no longer closes the inspector and starts a competing zoom-out first. Raw domain-access metadata is summarized behind a bounded disclosure below traffic, relationships, and memory details; bloomed memory nodes now expose hover and accessible click feedback.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.19 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.19. SDK 11.18.19.

What's New in v11.18.18

Codex upgrades now repair stale SAGE lifecycle hooks automatically. On every MCP startup, the project self-healer compares all five installer-owned Codex hook scripts with their fully rendered current templates. A mixed generation can no longer pass merely because the files exist or another hook mentions the current binary. Upgrading therefore replaces legacy no-op Stop hooks and malformed prompt hooks without requiring a second manual sage-gui codex install run.

The CEREBRUM Connectome now leads with the graph itself. Neurons have a larger practical click target; clicking one opens its persistent identity, visible incoming/outgoing traffic, strongest peer, directed connection list, and visible memory lobe. The compact fallback selector now shows only agents with visible peer relationships, ordered by retained traffic, instead of turning a large dormant/test roster into the primary navigation surface. Isolated authorized neurons remain visible and clickable in the brain and join the selector while selected.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.18 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.18. SDK 11.18.18.

What's New in v11.18.17

Routine MCP restarts no longer make the same stdio agent disown its own unfinished messages. The primary stdio runtime now persists one opaque claimant identity per exact signed agent, provider, and project under SAGE_HOME, and holds an OS advisory lock as the liveness fence. A later runtime reuses that identity only after the earlier process is no longer live; a genuinely concurrent runtime receives an independent identity and retains the existing one-handler and compare-and-swap handoff boundary. In-place installed-binary handoff also carries the current claimant identity while the old process keeps the lock alive.

The fix is deliberately prospective and does not bulk-transfer historical claims created by pre-v11.18.17 random process identities. Those rows remain visible through claimed_elsewhere_count and passive history and can still be transferred one at a time with the existing CAS-fenced handoff after the old claimant is known dead. HTTP MCP conversations remain transport-scoped. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.17 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.17. SDK 11.18.17.

What's New in v11.18.16

Claimed agent work no longer disappears from the inbox that claimed it. sage_inbox now returns a separate bounded own_claimed_unfinished projection for messages already owned by the exact current agent session. The projection is passive: it never claims, refreshes, transfers, or duplicates work, and it does not change the established items or count meaning of newly available work. Exact agent/session filtering, completion and expiry handling, bounded results with an exact total, reply-after-repoll, and nonmutation are pinned by store, REST, and MCP regression coverage.

The payload-free hook status path also checks the durable wake snapshot, so claimed-but-unfinished work cannot be reported as a clean inbox merely because no unclaimed row remains. Older or temporarily incapable nodes degrade to an explicit unavailable state instead of either a false zero or a failed primary inbox call. This patch does not automatically transfer claims from another session; passive history plus explicit compare-and-swap handoff remain the recovery boundary. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.16 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.16. SDK 11.18.16.

What's New in v11.18.15

Every unfinished exact-recipient local canonical message now has a durable wake generation, including upgrade-era claimed-only work and sends through the deprecated pipe route. Startup backfill covers both pending and claimed rows, so a recipient whose only live work was already claimed cannot reopen as the silent {seq:0,pending:true} state. Keyed exact-local pipe sends use the canonical idempotent admission path; unkeyed sends insert the row and advance the same recipient sequence atomically. Publication happens only after commit, exact replays do not republish, and an incapable backend fails before insertion rather than creating durable work that wake consumers cannot observe as new.

The experimental Claude notification adapter is explicitly opt-in again. The shipped Claude Code host registers the custom notification handler, but end-to-end delivery from a plain .mcp.json server through its plugin-scoped gate remains unverified. An idle adapter would also acquire the one exact-agent wake lease and exclude a useful long-running consumer. SAGE_CLAUDE_CHANNEL=true enables it for an operator who has confirmed that delivery path.

Pending-memory presentation is deterministic even when creation timestamps tie: SQLite and PostgreSQL both use memory_id as the final ordering key. The documentation citation guard now parses newline-separated and hyphenated paths, pins every concrete declaration/lead/interior anchor, repairs only explicitly accepted declaration anchors, refuses semantic locations it cannot reconstruct, and inventories the remaining legacy skipped and bare references. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.15 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.15. SDK 11.18.15.

What's New in v11.18.14

Durable agent messages now stay visible until the work is actually finished. Claiming a message no longer makes the payload-free wake surface go quiet: both pending and claimed rows remain unfinished, a reconnect at the current cursor receives an immediate wake, and sage_inbox reports an exact payload-free claimed-elsewhere state instead of a bounded-scan false zero. Claude Code project sessions arm the signed wake channel by default, while the optional Stop hook reads a lease-free monotonic snapshot so new or stranded work can nudge a session once without stealing the live SSE consumer lease.

The same recovery path is honest at its edges. A claimant-session fence rejection remains a typed conflict instead of masquerading as a missing message, and history plus explicit compare-and-swap handoff remain the only way to recover another session's claim. Canonical retention migration now rescues only the exact historical 24-hour stamp, preserving a sender's chosen bounded TTL across every store reopen, including RFC3339 nanosecond timestamps.

CEREBRUM's Connectome now identifies the agents it renders. Hover details are positioned and escaped reliably, while click, tap, and keyboard selection open one persistent inspector with exact agent identity, visible retained traffic, peers, activity, and an independently loading visible-memory lobe. Selection survives authorized live refreshes, error and empty states stay truthful, mobile uses a bounded sheet, and reduced-motion and established Connectome guidance remain intact.

Agent-as-lobe corroborator reads now use one deterministically ordered bounded batch instead of an N+1 query pattern, with matching SQLite and PostgreSQL ordering. The MCP contract also states the server-enforced 31-day sage_timeline range rather than advertising requests the server rejects. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.14 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.14. SDK 11.18.14.

What's New in v11.18.13

Hubanov's distributed-engram contribution now connects memories to the neurons that corroborated them. CEREBRUM keeps agent and memory identities in separate graph namespaces, rejects stale bloom generations, and removes every transient bridge on focus or graph replacement. The server uses a deterministic, indexed 96-row evidence prefix and exposes at most 12 authorized bridges without turning historical corroboration into a claim of current possession.

Claude's production wake source can now arm the payload-free message bus. When explicitly enabled with SAGE_CLAUDE_CHANNEL, the MCP runtime consumes the existing signed SSE wake route with a random process lease and resumable cursor. Delivery applies backpressure instead of dropping the newest wake, and shutdown releases saturated readers without leaking goroutines or claiming message content.

The Connectome no longer floats an instructional card over the brain. Its guidance lives in the existing reading panel, the mode toggle keeps one stable name and visible pressed state in both themes, keyboard focus remains clear, mobile Reset behavior stays intentional, and view changes are announced to assistive technology.

This patch also closes a claimant-session compatibility bypass: a current typed 404 is authoritative, the deprecated pipe-result alias carries the active MCP session, and only a genuine old-node route miss may fall back. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.13 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.13. SDK 11.18.13.

What's New in v11.18.12

CEREBRUM can now open an agent as a memory lobe. Selecting a connectome neuron lazily blooms that agent's highest-confidence visible memories as engrams, while retaining the operator-only route and app-v23 per-record projection checks. The indexed, bounded query avoids whole-brain scans; stale, failed, and disposed frontend requests cannot leave another agent's lobe on screen.

Dashboard live activity is now guarded as one exact 20-event registry. The seven previously unwired operator events now reach the existing dashboard SSE stream, while message wake, MCP, and wizard protocols stay route-local. A fail-closed typed control-flow audit and executable browser contract reject dead, aliased, escaped, build-tagged, or decoy event sinks.

Signed task creation and message attribution now agree end to end. Every official task constructor explicitly signs the required initial planned status, and REST fails fast instead of mutating an omitted signed field into a transaction that app-v23 through app-v26 must reject. Authorized message and pipe responses retain exact immutable agent IDs alongside mutable presentation labels, use one bounded batch metadata query on healthy production stores with a bounded exact-ID fallback, suppress foreign-chain label collisions, and keep count-only responses identity-free.

This patch also repairs release-facing documentation drift, pins the current 33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the references it can verify. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.12 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.12. SDK 11.18.12.

What's New in v11.18.11

The CEREBRUM connectome now fires live without widening its operator-only boundary. Successful local message sends emit a contentless invalidation tick; the browser then refetches the existing caller-filtered snapshot and pulses only newly observed synapses. Monotonic generations preserve later ticks across in-flight requests, ordinary reloads, failures, and retries, while initial loads and unrelated refreshes never create false activity.

Dashboard retrieval activity no longer duplicates authorized memory plaintext into the global operator stream. Recall, search, and hybrid events now expose only their event type and result count. The obsolete expandable plaintext panel is gone, and serialized-frame regressions pin the contentless contract and live, non-replayed delivery.

Claude bookend sessions can discover waiting SAGE messages without claiming or revealing them. A signed, payload-free inbox-status hook reports only the current identity and unread count, makes failures visible, preserves unrelated user hooks during self-heal, and exposes the read-only message tools needed to perform the explicit inbox fetch.

This patch also keys local connectome locality by chain identity, removes a stale app-v7 validator warning after app-v14, dims the connectome skull for legibility, requires patched Go 1.25.13 throughout current builders and CI, and publishes checksum sidecars for Windows executables. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.11 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.11. SDK 11.18.11.

What's New in v11.18.10

Multiple MCP runtimes sharing one agent identity can no longer silently lose track of claimed messages. Every MCP conversation now has an opaque claimant session ID. Atomic inbox claims persist that session in passive history, an explicit compare-and-swap handoff transfers work between runtimes, and a stale former owner is rejected if it tries to reply after ownership moved. Receive tokens remain replay-safe after a lost response, while legacy direct REST clients retain their existing agent-level compatibility path.

CEREBRUM can render the agent message bus as a live connectome inside the 3D brain. Registered agents become domain-coloured neurons, directed channels become traffic-weighted synapses, and hub agents settle toward the core. The view consumes the existing RBAC-filtered synapse projection, drops ghost edges, and fences asynchronous mode switches so a slow memory response can never be displayed as connectome data.

Upgrade-watchdog submissions can no longer hold a signing key's nonce lease for the process lifetime when CometBFT wedges. One bounded context now covers both lease acquisition and the broadcast. A deadline after submission remains a typed indeterminate outcome, so the exact signer and bytes stay fenced until their fate is reconciled; elapsed time never releases the key fail-open.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.10 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.10. SDK 11.18.10.

What's New in v11.18.9

Ambiguous CometBFT commit and sync outcomes are now typed at the shared broadcaster boundary. Transport, status, RPC, decode, shape, hash-binding, and missing-height failures return ErrSubmitIndeterminate for valid signing keys, while the existing live-registration path remains an independent fence backstop. Pre-send request-construction failures remain definitive and do not fence a key over bytes that never reached a transport.

Federation sync now fails closed if its commit broadcaster ever violates its contract by returning neither a result nor an error. The exact signer and encoded transaction remain fenced until reconciliation proves their fate, instead of releasing the key for a potentially in-flight transaction. A new cross-package decoder contract also pins the HTTP prologue shared by internal/tx and the CEREBRUM web path while recording their deliberate verdict and envelope-tolerance differences.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.9 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.9. SDK 11.18.9.

What's New in v11.18.8

CometBFT transaction submissions no longer permit Go's HTTP transport to transparently redeliver a fenced request after a reused connection fails while reading the response. Commit, sync, byte-identical nonce-fence reconciliation, and CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam. Each submission call writes its transaction on one connection and returns an indeterminate result instead of silently delivering the same signed bytes to a second responder. Restart failure reporting also preserves the signer-fence veto ahead of a generic drain timeout.

MCP reply polling now fails safe when a caller presents an unsafe forward watermark. If reply_since is later than the authoritative retained-reply head, or no head exists to validate it, sage_inbox returns the newest passive reply page for deduplication instead of filtering a formal reply into a false empty result. Complete recovered pages become a new safe baseline; truncated pages require composite-cursor catch-up, and failed page reads never claim recovery. A successful outbound sage_message_send also performs one bounded, sender-exact passive inbox snapshot so an inbound message that arrived after an earlier empty poll is surfaced during continued coordination.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.8 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.8. SDK 11.18.8.

What's New in v11.18.7

Large signed transactions now use a bounded CometBFT transport instead of overflowing request headers. Existing smaller broadcasts keep the established GET wire shape, while large commit, sync, and byte-identical nonce-fence reconciliation requests use JSON-RPC POST with base64 transaction bytes. Client transaction and JSON-RPC body limits are independently range-checked, capped at 8,000,000 bytes, and refuse an oversized request before send. Operators raising them must configure matching CometBFT limits. Independently, every validator enforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic finalization, sufficient for the measured 1,304-entry SkillRegistry transaction. Memory content remains bounded at 512 KiB, while the canonical signed AgentRequest proof has its own 600,000-byte consensus bound, admitting the measured 573,723-byte proof without widening the content or aggregate limits. Response handling accepts strict quoted or numeric int64 heights, rejects fractional, exponent, null, malformed, and out-of-range heights, and refuses unsupported content types.

Federation route refresh no longer risks recursively acquiring the sync-policy read lease from a peer-request caller. Opportunistic refresh admission is policy-free and bounded to one pending refresh per peer; the agreement and binding lookup runs asynchronously after the request caller can release its lease. Failed-request and successful-Direct triggers remain covered, while the route-exchange endpoint does not self-trigger refresh.

P2P-only peers can recover when their stored route snapshot is missing or belongs to an older trust generation. Only the authenticated /fed/v1/p2p/routes bootstrap exchange may use stale or current route addresses as connection hints; the current agreement's pinned mTLS identity remains authoritative. Protected requests reject missing or cross-generation snapshots with trust_generation_mismatch. A matching-generation empty target set remains explicitly pinned and cannot fall back to current configuration.

Federation diagnostics now give security evidence precedence over route availability evidence. Mixed route-availability plus certificate, SPKI, pin, identity-mismatch, or security-block evidence is classified as security_blocked; revocation, expired or unknown agreement, trust-failure, or authentication evidence is classified as trust_failure. Both verdict classes outrank route availability.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.7 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.7. SDK 11.18.7.

What's New in v11.18.6

Updater snapshots now prove both supported CometBFT layouts before they are published or reused. Application Badger and persisted consensus state must match at height H and agree on the application hash. A blockstore committed through H is accepted only after its H block ID and seen commit match that state. If the blockstore is durably one block ahead at H+1, SAGE additionally verifies the complete block and part identity, direct-parent and state-derived header fields, last and seen commits, validator signatures, and CometBFT's replay-time block validation. Regression coverage restores the candidate and runs the real CometBFT handshaker, proving exactly one replayed block and safe restart reuse. Malformed or more-than-one-ahead provenance is rejected, and an invalid prior publication is quarantined before a valid replacement can be published. Cancellation always blocks executable updater handoff, although a safe snapshot may already have been atomically published. Non-empty H+1 evidence is retryable until application and state catch up.

Federation Retry now performs one bounded, exact-generation recovery workflow. Concurrent operator clicks share the same route refresh and authenticated status probe. Direct and relay targets are frozen to the active JOIN generation, HTTP 401/403 and certificate/identity failures stop before re-probing, and a revoke or re-pair during the response invalidates the result. Typed dashboard diagnostics distinguish missing or expired route bundles, stale Direct routes, unavailable relays, trust-generation changes, and legacy connections that must be paired again. Ordinary polling and mutating requests do not enter this retry path.

Memory-reassignment audit failures no longer place request-controlled agent IDs in logs. The source and target are represented by fixed 96-bit truncated SHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable incident correlation without allowing CR/LF or other control characters to forge log records.

This patch does not change consensus state or application activation. The ceiling remains app-v26; v11.18.6 introduces no app-v27. The signer fence also remains process-local: unresolved submissions still require proof of fate, and crash/restart or a separate signing process is not claimed safe until durable cross-process pre-broadcast intent exists.

Container: ghcr.io/l33tdawg/sage:11.18.6. SDK 11.18.6.

What's New in v11.18.5

Long-lived stdio MCP sessions now follow an installed SAGE upgrade without executing a request under stale tools. The MCP process snapshots the exact executable that started it. If the app bundle or binary is atomically replaced, the next unread JSON-RPC frame is handed to the new executable together with the remaining stdio stream. The upgraded runtime—not the stale process—receives that request. The old runtime never executes the handed-off frame; transport failure remains an ordinary indeterminate outcome for callers to reconcile. Sessions initialized on 11.18.5 advertise MCP tool-list change support; the replacement emits notifications/tools/list_changed only after the logical session has completed initialization, so conforming clients refresh cached definitions as well as runtime behavior.

The unified coordination response identifies its live contract. Every sage_inbox result now carries coordination_schema: "sage.inbox.v2", the running mcp_runtime_version, and sender_replies_embedded: true|false. Monitors can therefore reject or report a stale pointer-only session instead of silently assuming that an empty addressed inbox also means no threaded reply arrived. The existing bounded reply_items, inclusive watermark, composite catch-up cursor, and passive sender-only authorization remain unchanged.

The upgrade from a pre-11.18.5 MCP process still requires one agent-session restart because that already-running older process cannot contain this handoff logic. Once a session starts on 11.18.5 or later, subsequent binary replacements use the automatic request-preserving handoff. Clients that ignore the negotiated tool-list notification must still re-list tools or reconnect to discover new definitions.

The consensus ceiling remains app-v26; v11.18.5 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.5. SDK 11.18.5.

What's New in v11.18.4

One inbox poll now surfaces both new work and threaded answers. sage_inbox returns replies to messages you sent under the separate passive reply_items key by default, while genuine inbound work remains under items. Reply rows never inflate work counts and explicitly require no reply. Inclusive reply_since polling prevents same-millisecond loss; truncated pages fail safe with an exact composite-cursor catch-up action and forbid advancing the watermark until the window is drained.

Release builders now enforce the patched Go floor. Root and natter modules require Go 1.25.12, CI and release jobs resolve that exact go.mod toolchain, every Go container builder uses 1.25.12, and pinned govulncheck v1.6.0 scans both modules before either CI fan-in or release publication can pass.

Legacy pipeline retention compares time chronologically and conservatively. SQLite purge eligibility no longer relies on variable-width RFC3339 text. Cutoffs are floored to SQLite's millisecond precision, so ambiguous same-millisecond rows are retained rather than deleted early; malformed read evidence also retains fail safe.

The consensus ceiling remains app-v26; v11.18.4 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.4. SDK 11.18.4.

What's New in v11.18.3

Same-key consensus submissions now fail closed across every producer in the running daemon. The dashboard, REST API, federation manager, voter, and upgrade watchdog share a per-key nonce lease. Once exact transaction bytes reach CometBFT, any unproven transport, status, RPC, decode, shape, hash, or height outcome fences that signing key until reconciliation proves those same bytes committed or permanently refused. Strict shared Comet decoders require a single bounded JSON document, explicit nested verdicts, the exact transaction hash, and a positive committed height for success.

Update restart advice now follows live fence state. A completed download no longer leaves stale restart guidance behind: retained update status reads recompute whether restart is currently safe, and the dashboard renders the server-provided instructions. Coordinated restarts are refused when a fence is present. Crash, power-loss, cross-restart, and separate-process CLI exposure still require durable pre-broadcast intent and remain explicitly out of scope.

The consensus ceiling remains app-v26; v11.18.3 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.3. SDK 11.18.3.

What's New in v11.18.2

A reply to a message you sent is readable again, through an advertised MCP tool. Previously a recipient could answer, the durable row flipped to completed, and the answer was reachable only through the passive REST projection GET /v1/pipe/results — which no MCP tool ever called. sage_inbox shows work addressed to you, not answers to you, and sage_message_status is sender-only but deliberately payload-free. So in MCP and bookend clients the reply was invisible and work round-tripped. v11.18.2 adds sage_message_replies as an explicit sender-side read (SAGE now advertises 32 MCP tools) plus a payload-free pointer inside sage_inbox that reports how many replies are retained without ever presenting them as new work.

The reply read is exact-sender-only, passive, and honest about provenance. Authorization is the SQL predicate from_agent = ? against the caller's own signed identity — not the wider callerCanViewPipe rule the workflow route uses — and no parameter names another agent, so the tool cannot serve as a message-existence oracle. Reading claims nothing, acknowledges nothing, and re-queues nothing. Every body is labelled untrusted data and attributed to the agent that actually wrote it rather than the agent you addressed. GET /v1/pipe/results gains a payload-free ?count_only=1 probe and a composite (completed_at, pipe_id) before= cursor, so replies sharing a millisecond are never stranded behind the page boundary. A store backend lacking the optional capability answers 501 instead of an empty page that would read as "no replies".

Memory, agent, RBAC, federation, and consensus behavior are unchanged; app-v26 remains the binary ceiling and v11.18.2 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.2. SDK 11.18.2.

What's New in v11.18.1

MCP session guidance now uses the protocol surface intended for it. SAGE runs its per-session boot standing during initialize and returns the adaptive full, bookend, on-demand, pending-review, or unavailable guidance through initialize.instructions. The first real tool result is therefore only that tool's payload instead of being prefixed with a 1.5–2.9 KB auto-connect block. Repeated or concurrent initialization in one transport session reuses the same standing without duplicating signed registration or caller-scoped reads. Clients that skip the MCP initialization handshake keep the one-time first-tool fallback for compatibility.

Legacy-lineage recovery now represents real skip-ahead history truthfully. When retained Comet history proves a version jump such as 1→7 or 8→11, the app-v21 doctor emits a v2 transition claim at the real activation height and records the skipped predecessors as virtual, subsumed coverage. It never invents interleaved heights or writes synthetic upgrade:applied:* records. Every validator independently replays the retained history and hashes before an explicit vote, and the immutable audit is installed atomically only when app-v22 activates. Existing valid v1 receipts on already-upgraded app-v22+ chains remain readable; new v1 repair proposals fail closed.

The lineage change is confined to the exceptional app-v21 → app-v22 recovery ceremony. Memory, agent, RBAC, and federation policy are unchanged; app-v26 remains the binary ceiling and v11.18.1 introduces no app-v27.

What's New in v11.18.0

A connected pair is now the federation group users expect it to be. Each side explicitly exports the ordinary local agents it places in that pair. Every active ordinary agent on the other SAGE may then live-read those exported agents' owned domain trees by default—no matching local group, receiving domain, or linked-reader grant is required. A receiving operator can narrow that default with exact agent/domain denials. Local-only group membership is never exported transitively, and adding another federated agent is an explicit new export. Read remains borrowed; Copy still requires a source offer plus the receiver's Save here subscription, while remote memory Write remains reserved and fails closed.

Federated authorization now stays true through disclosure. The signed Read plan and single-use challenge bind the exact source-agent standing, clearance, export, agreement, policy generation, and negotiated authorization model. The source authorization lease is revalidated and held until the destination query finishes, so a concurrent rename-safe identity change, restriction, ownership change, pause, or revoke cannot leak a result. CEREBRUM and sage_federation also report authenticated-read readiness honestly, and the Docker acceptance lane proves default Read, explicit denial, non-transitive exports, bidirectional Copy backfill/incremental sync, and restart recovery.

People can address agents without giving up canonical identity. Local and federated message targets accept a unique display or immutable registered name; the resolved request and wire proof still carry only the canonical agent ID and chain. Ambiguous local/remote collisions fail with bounded immutable choices instead of selecting the first label. Federated replies now return an immutable reply_event_id, and the replier can query that exact event's delivery status without pretending it is a new inbox message.

Access Controls is now one usable control surface. Dedicated Agents, Groups, and Federation tabs use compact searchable/sortable lists and focused detail drawers instead of mounting every permission matrix at once. Modern and legacy URL deep links preserve the selected tab and exact local or federated identity. Dialog/drawer focus ownership, Escape/Tab handling, ARIA labels, and narrow-screen behavior are covered by browser-contract tests.

JOIN and upgrade recovery are bounded and explicit. A JOIN session still expires after 15 minutes, while each pasted/scanned code gets up to five minutes of Direct/relay discovery as long as its pairing screen remains open. v11.18.0 is also the first concrete release containing stopped-node backup --full, recoverable restore --from, upgrade preflight, and the app-v21 → app-v22 upgrade lineage status|doctor|verify workflow. A legacy-lineage repair is create-only, chain/current-state bound, embedded in the exact immutable upgrade proposal, never auto-voted, and requires every validator to verify and vote explicitly; an unverified anchor requires a deliberate acknowledgement.

The federation/UI work is off-consensus. The narrow lineage ceremony repairs only an eligible chain still at app-v21 before its governed app-v22 transition. Existing app-v22 through app-v26 chains are not rewritten, app-v26 remains the binary ceiling, and v11.18.0 introduces no app-v27. Both SAGEs should run v11.18.0 for the complete signed federation tuple; older peers fail closed rather than silently downgrade it.

Container: ghcr.io/l33tdawg/sage:11.18.0. SDK 11.18.0.

What's New in v11.17.15

Blank home-domain approval now does what the form promises. When an operator approves a writable pending agent without typing a home domain, CEREBRUM derives a readable slug from that agent's committed name, adds a cryptographically random suffix, and includes the resulting unowned domain in the same dual-signed approval transaction. An explicitly entered domain still wins. The unpublished v11.17.14 workflow was canceled after this browser-found regression, so v11.17.15 is the first published release containing the changes below.

Bulk domain recovery now completes on idle personal chains. CEREBRUM keeps an explicitly confirmed multi-domain transfer alive across the existing 50-block governance cooldown, shows the current/required block while consensus advances, and stops on every non-cooldown failure. Confirmed batches belong to the CEREBRUM session rather than one screen, so operators may navigate away and enqueue another transfer behind the active governance job. If an idle CometBFT clock rejects the first app-v20 authorization as too far ahead, the server re-signs the exact request once against the newly committed chain time; the proof window and every consensus authorization check remain unchanged.

Companion inbox setup now matches the profile’s purpose. Choosing the Companion/voice-bridge preset enables connected-SAGE inbox messaging by default; the independent emergency block remains available afterward. If an existing agent is blocked, Federation now keeps the warning visible and provides a one-click path to that exact agent and inbox switch in Access Controls.

v11.17.15 also contains the v11.17.13 Agents directory and Linux packaging changes below; v11.17.13 and v11.17.14 were never published after their release runs were canceled.

Included from v11.17.13

New agents now appear where operators expect them. Agents waiting for first approval are separated from activated local principals and shown in a conditional review queue at the top of Agents, with the existing atomic approve/reject controls. Access Controls remains focused on activated local agents. Exact ordinary agents advertised by connected SAGEs now have a distinct From federation directory, including whether read-only group permissions are unset or already linked; permission setup opens the existing Linked readers control focused on that exact agent_id@chain pair. Federation transport, ceremony, and Root identities are never cast as ordinary agents.

Linux preview packaging survives transient helper outages. The native-shell gate preloads every Tauri AppImage helper through a three-attempt bounded retry, an atomic reusable cache, and an exact SHA-256 allowlist. Partial or corrupt entries are rejected, retries report the helper and attempt, and persistent or changed upstream artifacts fail with deterministic diagnostics instead of being silently trusted.

This patch also refreshes the pinned Go runtime dependencies and CodeQL action. It changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place.

Container: ghcr.io/l33tdawg/sage:11.17.15. SDK 11.17.15.

What's New in v11.17.12

Federation agent sharing now fails safely and explains the real policy. The agent picker checks the selected local agent's federated-inbox capability before changing any shared domains, so an inbox blocked by policy can no longer leave a partial domain share followed by a misleading refresh error. Access Controls now shows an explicit Allow messages from connected SAGEs switch and changes only the independent federation-deny bit; Companion agents keep their existing role, clearance, home domain, and other restrictions.

The Tasks board stays inside the viewport. Four- and two-column layouts now allow every track to shrink below its content's intrinsic width, so long Done or Dropped cards wrap inside their columns instead of creating a page-level horizontal scrollbar or clipping the final column.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.12. SDK 11.17.12.

What's New in v11.17.11

CPU-only embeddings are faster, bounded, and observable. Native Ollama and OpenAI-compatible batches replace per-record request loops, concurrent identical work is coalesced without retaining a cross-agent plaintext cache, imports embed in bounded windows after authorization, and MCP clients let current SAGE nodes authoritatively queue their own vectors. Provider, model, dimension, timeout, managed-Ollama, and amid configuration now describe one coherent vector space. A reproducible sage-embedding-bench command and CPU deployment guide cover measurement and tuning.

Idle nodes can transfer domains again. Newly signed dashboard governance proofs use the fresher safe clock when the latest committed block is old, while the consensus proof window remains unchanged and future-skewed clocks still fail closed. Federation connection details also expose Save and Revoke controls both above and below long permission catalogs, avoiding a full-page scroll.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.11. SDK 11.17.11.

What's New in v11.17.10

Federation visibility is symmetric again. CEREBRUM's single authenticated peer-status probe now preserves the peer-scoped domain permission and agent contact projections that the remote SAGE returned. A reachable connection can no longer show an agent from the other SAGE while claiming that its domains were never reported, and the reverse side receives the same shared-agent view. Transport binding internals remain hidden from the dashboard response.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing v11.17 chains upgrade in place without rewriting trust, domain grants, agent acceptance, memories, or history.

Container: ghcr.io/l33tdawg/sage:11.17.10. SDK 11.17.10.

What's New in v11.17.9

CEREBRUM's agent and recovery surfaces now reflect the operator's model. Friendly renamed-agent labels are used consistently, the Access Controls agent rail is wider, and the Agents directory is searchable by name or ID and sortable by recent presence, recent committed memory, or name. The busy agent directory now appears before the low-traffic governance controls. Federation permissions use separate outgoing and incoming tabs, so a large local domain catalog no longer buries the peer's shared-back view below an endless matrix.

Domain transfer recovery is ownership-safe and retry-safe. The dashboard distinguishes immutable memory authorship from canonical domain ownership, excludes the actual current owner from transfer targets, and treats a replay of an already-committed transfer as success. Governance proof timestamps are bound to the latest committed CometBFT time, preventing false five-minute-ahead rejections on recovering or CPU-starved nodes.

Messages now behave like an inbox, not a short-lived pipe. Omitted/zero TTL keeps local and federated work durable until handled, v11.17.8 unread rows are extended during upgrade, and canonical inbox/outbox history is no longer swept by the legacy 24/48-hour pipeline retention jobs. Callers can still request an explicit 1–1440 minute expiry.

sage_turn now reports only message_inbox_unread and its count; it never claims or injects message payloads. Agents call sage_messages_receive to read the inbox and use status/history for replies and lifecycle evidence.

Container: ghcr.io/l33tdawg/sage:11.17.9. SDK 11.17.9.

What's New in v11.17.8

The v11.17 security backlog is cleared in code. Pion DTLS and STUN are upgraded to their patched releases in both the SAGE and Natter modules. Recall result slices no longer use caller-derived allocation hints, app-v23 migration keys avoid length-arithmetic preallocation, and the CEREBRUM inline-script contract recognizes HTML tag case without a fragile sanitizer-style regexp. The roadmap, architecture, federation guide, onboarding guide, and Python SDK docs were reconciled to the then-current canonical Messages API and 24-hour default TTL (superseded by v11.17.9 durable-until-handled delivery), deprecated hidden sage_pipe* aliases, app-v26 authority names, signed macOS in-place updater, and the remaining physical acceptance boundaries.

Container: ghcr.io/l33tdawg/sage:11.17.8. SDK 11.17.8.

What's New in v11.17.7

Releases no longer pause for a manual two-Mac approval. Publication still requires the exact staged macOS applications and DMGs to pass writable-copy, launch, signature, Team ID, notarization, and stapling verification, then continues automatically through immutable package and GitHub publication.

Federation now recovers across LAN changes, internet relays, restarts, and roaming addresses. Signed route snapshots retain the stable peer identity, rank safe Direct and Secure relay candidates, republish after relay reservation changes, and migrate v11.17.4 p2p_peers state without treating stale routes as authorization. Unsafe DNS, loopback, link-local, unspecified, multicast, mixed peer-ID, and wrong-protocol routes fail closed.

Federated agent discovery and Messages now work as one durable inbox. Exact peer_chain lookup disambiguates same-named agents. A previously authenticated exact address can be queued while its node is offline, remains caller- and policy-bound across restart, and is revalidated before any payload leaves the sender. Canonical status independently reports transport, exact-recipient read, and workflow completion to the original sender. Legacy sage_pipe* tools stay callable for compatibility but are no longer advertised to new MCP clients.

A reproducible Docker federation acceptance lane covers the real product path. It exercises same-LAN links, relay-only isolated networks, both-sided IP churn, relay outage and recovery, expired route snapshots, v11.17.4 migration, offline queueing, recipient inbox/read/reply, and final sender confirmation.

Container: ghcr.io/l33tdawg/sage:11.17.7. SDK 11.17.7.

What's New in v11.17.5

Federated agent sharing now sends the canonical permission wire shape. Choosing a named local agent may add the domains that agent owns to the trusted connection. That automatic path now serializes the same permissions array as the normal domain editor, so the peer can expose the agent contact and the two agents can use canonical Messages/Inbox over the existing direct-or-relay link.

Upgrade recovery accepts the first valid revision-zero snapshot. Legacy databases can legitimately publish their first preserved-record inventory at projection revision zero. CEREBRUM can now deprecate an exact selected subset of that inventory while still requiring the revision field, positive count, typed confirmation, current Root authority, and atomic queue validation.

Federation enrollment now carries one validated route bundle from JOIN to roaming operation. Direct and secure-relay candidates survive the ceremony, the dashboard reports the route that actually carried authenticated traffic, and stale host windows fail closed. Canonical agent messaging uses the exact linked-reader relationship plus independent receiver-local consent on the same direct-or-relay transport.

Canonical Messages are the public agent-to-agent workflow. sage_message_send, sage_inbox, sage_message_reply, sage_message_status, and sage_message_history cover idempotent send, receive, reply, receipts, and restart-persistent history. Legacy sage_pipe* MCP tools remain compatibility aliases but are explicitly deprecated. The federated proof verifier accepts the sender-local idempotency field in the exact signed request without exporting that replay token into the peer event. New messages now default to the full supported 24-hour inbox lifetime, rather than expiring after one hour while a recipient agent may be offline.

CEREBRUM recovery and consensus stay usable on upgraded nodes. The consensus page authenticates its scope request, incompatible historical domain-continuity candidates are retired instead of being reproposed every block, and recovery deprecation records an honest recovery activity event. The recovery authority controls use a responsive grid, so the explanatory copy and selectors no longer collapse into a horizontally scrolling row. Access Controls also normalizes historical empty groups to members: [], so a valid empty group cannot throw during the first render and leave the page stuck on “Loading consensus access policy…”.

Historical app-v25 home defects no longer prevent app-v26 repair from starting. Nodes with the narrow legacy shared_home shape may rebuild their local agent serving projection long enough for the existing deterministic app-v26 migration to run. Eligibility and validation share one Badger snapshot, completed app-v26 chains stay strict, and a concurrent repair falls back to one strict retry. This changes no memory, historical author, ownership history, or prior block outside the already-governed app-v26 repair.

Large federation agreements stay responsive. CEREBRUM renders bounded 75-domain windows, keeps existing grants and retained subscriptions first, and skips reconciliation when polling returns identical state. Search, bulk actions, and Save still operate on the complete filtered permission set and full draft rather than only the rendered rows.

Local MCP clients use the listener SAGE actually binds. Generated configs, hooks, bundles, and internal defaults now use 127.0.0.1 instead of allowing localhost to resolve to an unbound IPv6 ::1. sage_find_agent also preserves its bounded federated continuation cursor when a fuzzy local result exists, so a caller can explicitly request the next peer page without any automatic federation walk.

App-v26 makes Access Group authority explicit and reviewable. Every local group now stores one deterministic member authority: read, read_write, or read_write_modify. Existing groups migrate to the safe read baseline at the strict H+1 fork boundary. A domain owner always retains full control of its own domain; group membership is additive, the strongest applicable group wins, and removing an agent revokes only that cross-member relationship without touching the agent's own domains. Linked federated agents remain read-only guests and can never acquire local Write, Modify, ownership, or governance.

Local agent messaging now has one canonical, durable receipt contract. An idempotent send, exact receive-batch replay, recipient-only reply/read acknowledgement, and sender-only payload-free status projection use the existing encrypted pipeline inbox rather than a second queue. Connected HTTP MCP SSE sessions for the exact recipient may receive a metadata-only wake-up; this is a best-effort hint, never presence, delivery, comprehension, or read evidence. The enforced sage_turn reminder/checkpoint nags are removed.

CEREBRUM helps Root finish historical recovery instead of leaving a warning. Unresolved preserved records can be inspected through bounded safe previews, selected, assigned to an active local ordinary agent when exact verified evidence permits it, or deprecated. Already-deprecated rows are excluded. Authorship, content, domains, and chain history remain immutable; assignment changes only current operational ownership. Conflicting or unverifiable rows remain deprecate-only.

Linked SAGE discovery closes over the relationship agents can actually use. Caller-scoped directory results include only consented linked peers and expose their exact address plus registered/display name metadata. The same authority is enforced for direct and secure-relay paths; discovery grants no remote memory write or local group membership.

Operator mutations and signed updates fail safely without lying. CEREBRUM reconciles uncertain consensus responses against canonical state and repairs the local agent projection after a committed approval. Access Controls can also commit a new agent display label without changing its immutable registered name, agent ID, boot purpose, domains, or authorship; the rare Root handover card now sits below everyday agent and group controls. The macOS release gate mounts the signed DMG, copies the app to a fresh writable APFS location, verifies the exact leaf identities and version before and after first execution, and publishes only that verified immutable asset. CEREBRUM now stages that signed DMG, verifies the replacement, swaps the installed application through a separate helper, and restarts into the new build with bounded readiness checks and rollback. Manual drag-and-drop remains the explicit fallback. Linux keeps its verified in-place updater.

This is a governed consensus upgrade from app-v25 to app-v26. Existing chains advance in place; memories, historical authors, domains, and prior blocks are not rewritten.

Container: ghcr.io/l33tdawg/sage:11.17.5. SDK 11.17.5.

What's New in v11.16.4

Existing nodes recover from stale app-v23 serving projections at startup. A rebuildable local SQLite projection whose old duplicate policy fields disagree with the canonical committed enrollment is normalized from that canonical policy record instead of preventing the node from starting. This is a local read-model repair only: it does not alter blocks, memory content, historical authors, domains, access groups, or the consensus application version.

The release pipeline verifies the installer that users actually download. After macOS packages upload, CI downloads the staged DMG, checks its checksum, mounts it, and verifies the app signature, Gatekeeper assessment, and notarization before publication. The MCP server also no longer spends an agent's context budget on repeated per-tool sage_turn reminder messages.

Claiming a message no longer makes it disappear for either participant. The active inbox remains a pending-only, claim-on-read work queue so old work does not reappear in every turn. A new passive retained inbox/outbox history lets the recipient reopen claimed or completed work and lets the sender revisit its local lifecycle until the normal transient pipeline retention sweep. Agents can also list the signed active local directory—with display name, immutable registered name, provider, and exact agent ID—before addressing a message, instead of guessing a recipient from a fuzzy provider label.

CEREBRUM now settles operator actions against the canonical chain instead of undoing them in the browser. Clearing a terminal task column keeps cards out of intermediate refreshes while the local projection catches up, then reloads the authoritative board. A lost or late commit response is reported as confirmation in progress rather than the false claim that nothing changed; only a definite consensus rejection is red. A multi-manager deprecation that opens a challenge is shown honestly as awaiting its distinct eligible confirmation rather than called cleared.

Access Groups and agent recovery are usable in the flow operators actually use. Dragging one active local agent onto another creates or extends the narrowest local group, so members read each other's owned domains by default until the operator explicitly selects Read + write or Read + write + modify for that group. Global Manager labels never silently widen the selected group permission. Dragging a member back out revokes only that group relationship. CEREBRUM also settles agent removal and first-use domain authority against committed state, rather than leaving a stale progress screen or asking a newly-created domain to retry its first operation.

Federation no longer requires a relay reservation to use a working direct route. A trusted pair may connect immediately over its authenticated direct candidate—especially useful on the same LAN—and keeps the secure relay as an automatic roaming/NAT fallback. Direct-only route bundles now validate on both the dashboard and peer transport paths.

This patch does not rewrite memories, domains, historical authors, existing groups, or chain history. It keeps consensus application version 25 and the existing governed upgrade path unchanged. Existing nodes upgrade in place.

Container: ghcr.io/l33tdawg/sage:11.16.4. SDK 11.16.4.

What's New in v11.16.2

App-v25 repairs historical continuity without rewriting history. It is the strict H+1 successor to app-v24. New submissions receive an immutable canonical envelope: a memory ID can be replayed exactly, but cannot later be reused for different content, author, domain, or classification. That closes the old projection-overwrite path that could leave an agent able to write a domain but unable to read it back.

On upgrade, SAGE scans historical SQL rows against canonical state in the background. Complete, content-hash-verified records are adopted through bounded Root-authorized, validator-attested governance batches. No memory content, author attribution, domain, classification, or earlier block is rewritten. For each recovered local domain, the earliest verified historical writer is retained as the operational owner; every other verified local writer is restored into the exact local Access Group with read/write continuity. If the earliest writer is no longer a valid local principal, CEREBRUM Root owns the recovered domain rather than promoting a later writer by guesswork.

One bad historical row can no longer blank CEREBRUM or take agents offline. v11.16.2 quarantines each unverified record individually. Broad list/search, graph, timeline, stats, and dashboard-health reads continue with the verified set and disclose a partial-projection state. A completed audit returns /ready as HTTP 200 / degraded; actual backend failures and incomplete audits remain unavailable. This keeps supervisors, MCP bootstrap, sage_inception, and healthy agent work online without pretending incomplete data is safe.

Unreadable or conflicting records are preserved byte-for-byte. CEREBRUM Root can retry the evidence scan or explicitly deprecate the exact unresolved inventory after a typed confirmation; deprecation retires it from automatic repair and normal views but does not delete historical data. See App-v25 upgrade and recovery.

Container: ghcr.io/l33tdawg/sage:11.16.2. SDK 11.16.2.

What's New in v11.16.0

App-v24 closes the canonical terminal-hash lifecycle defect without rewriting history. New memory submissions bind content_hash to the exact SHA-256 of their content, and challenge, deprecate, and other terminal transitions preserve that canonical hash. App-v24 activates at the strict height after its app-v23 predecessor, so the activation block and every earlier block retain their exact historical semantics. A governed, Root-planned validator vote can re-anchor eligible historical terminal rows in bounded, atomic, idempotent batches from their unchanged canonical content. The repair changes neither content, authorship, domain ownership, nor prior blocks.

Fresh first-party Mynah nodes now wait for the safe protocol floor instead of starting mute or writing through the vulnerable interval. Direct app-v23 genesis remains the authenticated bootstrap origin, but /ready reports waiting_for_app_v24 until the next admitted transaction will execute under app-v24. Consensus independently rejects direct-genesis Companion memory and co-commit writes during that short governed climb, so bypassing the readiness endpoint cannot reproduce the defect. Personal nodes require app-v24 even when optional future auto-upgrades are disabled. This narrow barrier does not mute ordinary upgraded nodes: existing agents retain their app-v23 write authority while app-v24 activates.

Agent recall and caller-scoped discovery work again under the new access model. sage_turn now uses the shared local semantic-recall path and forwards the exact embedding provider returned by /v1/embed; it no longer misclassifies every turn as federated and then trips the app-v23 federated-vector gate. The signed sage_find_agent path again searches active ordinary local agents first and then only federated contacts authorized for that caller. It is discovery metadata, not presence: an empty match does not prove that a saved exact Agent ID is unreachable, and sends always revalidate the destination.

CEREBRUM RBAC now preserves the policy the operator actually approves. Companion enrollment accepts its documented 15/31 profiles, valid existing federated-pipe restrictions are not silently stripped, and a newly pending mask-30 principal becomes the documented Companion mask 15 only after approval. Encrypted and unencrypted loopback CEREBRUM use the same Root/Admin authorization boundary; an encrypted vault additionally requires its valid unlocked session. A level-2 grant is never presented as a cure for a hard capability, pending-review, profile, or ownership denial.

CEREBRUM no longer mistakes a missing ordinary-memory projection for an empty brain. App-v23 readiness now checks the complete canonical Badger inventory against the local SQL serving projection, so deletion, rollback, or partial projection loss returns 503 instead of a plausible zero-memory dashboard or empty backup. A state-sync receiver seals and node-key-signs the exact historical canonical IDs whose ordinary plaintext was intentionally not transferred; every memory committed after that baseline remains mandatory. Such a node reports canonical_subset, and portable full-brain export stays disabled rather than producing a partial file labeled as a backup. Pre-v11.16 receivers that do not have this exact authenticated baseline fail strict readiness and must be explicitly repaired or state-synchronized again; upgrade-time SQL state is never guessed into an omission allowlist.

Container: ghcr.io/l33tdawg/sage:11.16.0. SDK 11.16.0.

What's New in v11.15.1

Emergency CEREBRUM rendering recovery. v11.15.0 shipped one malformed nested-template expression in the Access Control view. Because CEREBRUM is a browser-module application, that single parser error prevented the entry module from executing and left the otherwise healthy local node behind a blank page. v11.15.1 corrects the expression and changes the static JavaScript release gate to parse every first-party file with browser-equivalent ES-module grammar, so this class of packaging failure is rejected before publication. A dependency-free Loading shell now turns future bootstrap failures into a sanitized recovery panel, and missing module assets return a true 404 instead of a misleading HTML 200.

This patch does not migrate, delete, rewrite, reassign, or re-encrypt memories. It changes no consensus rule, transaction, key encoding, AppHash input, fork height, or application version; app-v23 and every historical block remain byte-identical. Existing nodes upgrade in place. Container: ghcr.io/l33tdawg/sage:11.15.1. SDK 11.15.1.

What's New in v11.15.0

App-v23 replaced capability-bit administration with roles, security profiles, and Access Groups that match how people actually share a SAGE. Members can read the domains owned by other active local members of their groups. Managers could also write and modify within those same group boundaries under the original app-v23 rule; app-v26 supersedes that derivation with each group's explicit authority tier. Admins have sudo-equivalent authority over normal local data, policy, governance, federation, and CEREBRUM operations. Clearance remains the maximum classification an agent may read, and hard security-profile restrictions still override roles, groups, and grants.

CEREBRUM Root is now a separate, singleton authority rather than an agent card. It cannot be dragged into groups, messaged, demoted, or removed through ordinary agent controls. A dedicated two-confirmation handover rotates the current Root credential while preserving the immutable Root authority over its existing domains, grants, and groups. Historical memories keep the exact credential that authored them; new Root memories record the new credential. No chain history is rewritten, no domain is bulk-transferred, and retired Root credentials can never become agents or Root again.

Federated agents are linked readers, never remote members. A remote agent@chain may be attached to a local Access Group for live, classification-bounded reads only. It receives no Copy, Write, Modify, claim, ownership, grant, role, governance, or transitive-agent authority. Agent pipeline messages remain untrusted requests; any resulting memory action is a separate local decision made under the receiving agent's own identity.

First-party vendored companions no longer start mute. A clean Mynah / SAGE Voice Bridge installation atomically binds its exact key, reviewed Companion profile, clearance, local enrollment, and owned non-shared home domain before readiness succeeds by starting its fresh vendored node directly at app-v23. Mynah has no released legacy population, so there is no Mynah-specific upgrade or repair path. Other agents stranded by app-v22's default mask 30 remain pending review until a local Admin completes the atomic onboarding operation; they cannot self-promote or claim a domain.

CEREBRUM now enforces the localhost-only promise already shown in its UI. The human control plane, including authentication, recovery, RBAC, federation management, and the SPA itself, is unavailable over LAN or a federated link. On an unencrypted personal node, the real same-origin loopback SPA has complete Root control without inventing a password or copying the genesis key; when vault encryption is enabled, the same local surface additionally requires its unlocked session. Signed Admin/Root management is also local-only. Dedicated signed agent APIs, pairing/claim redemption, health, and federation data-plane traffic retain their designed network reachability.

App-v23 activates only after the canonical predecessor ladder through app-v22, with the activation block retaining v22 semantics and v23 beginning at the next height. Replay and state sync preserve every historical AppHash while validating the new Root, role, enrollment, group, and revision invariants. Personal nodes automatically walk the governed ladder to the required app-v23 security floor even when optional future auto-upgrades are disabled. Multi-validator networks must first install this exact binary on every validator, then activate app-v23 through their normal governed upgrade ceremony. Legacy or keyless MCP/OAuth bearers that could fall back to Root are revoked; current tokens require a distinct pending-review keyed identity. Vault-enabled nodes and unencrypted nodes both seal new token keys under the one-time bearer, so credentials survive optional ledger state changes, the stored database digest cannot decrypt them, and no bearer ever falls back to Root. Existing vault-sealed token rows migrate on their next unlocked use. Public OAuth authorization crosses an opaque, short-lived, single-use handoff into a localhost-only approval page—CEREBRUM, its cookies, and /ui are never exposed through the Cloudflare tunnel. SDK 11.15.0.

What's New in v11.14.2

Emergency CEREBRUM and updater recovery patch. Local installations with vault encryption disabled no longer open to a blank dashboard after upgrading: the real loopback CEREBRUM browser can read memories, search, use the task board, enable the vault, and apply or restart official verified updates. Unsigned background processes, LAN and cross-site browsers, ordinary signed agents, and sensitive operator mutations remain denied. The updater now prefers GitHub's immutable release-asset SHA-256 digest and uses checksum sidecars only as a fallback, removing the transient checksum-discovery failure that blocked some v11.14.1 upgrades. Existing memories were never removed by this issue.

SDK 11.14.2.

What's New in v11.14.1

SAGE now gives co-located companion agents a consensus-enforced least-privilege profile. App-v22 adds operator-controlled capabilities for clearance-bounded cross-domain reads while denying shared-domain writes, foreign-domain writes, and domain claims. The companion preset keeps local and federated agent inbox messaging enabled, so a voice bridge can delegate work to a visible agent on another compatible SAGE and relay its eventual result. Short-name agent lookup now searches bounded local metadata, so names such as mynah resolve without requiring the full registered display name. Direct remote memory Write remains unavailable: agents send a pipeline request to the remote agent, which performs any separately authorized local action. Codex's user-level MCP registration now derives a separate stable signing identity from each workspace folder instead of silently reusing global-codex; explicit custom key pins remain supported. CEREBRUM shows the exact signer ID beside every access grant so a display-name match cannot hide an identity mismatch, and its access matrix only filters and assigns domains already created by agents rather than asking an administrator to create domain tags. Fresh self-registrations after app-v22 start quarantined (mask 30): they cannot write or claim domains or use federated inbox routing until a global administrator assigns an intentional profile; existing agents retain their pre-upgrade mask.

App-v22 also refuses to be proposed, approved into a pending plan, activated, or restored unless consensus storage proves the complete predecessor ladder. The canonical persisted app-v6 record is the one compatibility proof for the historical cumulative app-v2 through app-v5 activation; app-v7 through app-v21 must each have their own canonical applied-upgrade record, with the exact target and strictly increasing positive activation heights. Missing, synthesized, or out-of-order v7+ evidence fails closed. Historical pre-v22 block replay is unchanged.

Agent inboxes now enforce an explicit prompt-injection trust boundary. Every local or federated payload is surfaced as an untrusted request_only request, never as system, developer, or user instructions; pipeline results are untrusted data_only content, and task notices are notifications that must be confirmed against the exact current backlog assignment. Tool descriptions, inception guidance, response metadata, docs, and regression tests all carry the same rule.

SDK 11.14.1.

What's New in v11.13.9

SAGE now closes the WebTransport memory-exhaustion advisory and makes task updates explicit. Root and Natter modules use patched WebTransport/QUIC dependencies. sage_task rejects immutable content replacements locally, requires an explicit status transition, and supports link-only updates without an implicit re-plan.

SDK 11.13.9.

What's New in v11.13.8

CEREBRUM now records committed permission changes in Chain Activity. Access saves, grants, and revocations show only after their transaction commits, with the block and transaction available on expansion. Chain Activity can now be resized even when it is empty, and its clear Expand/Collapse control works reliably from the header.

SDK 11.13.8.

What's New in v11.13.7

MCP identities are now isolated by client provider, and federation shares an agent with its owned domains in one guided action. Claude Code and Codex get distinct project keys, while explicit legacy keys remain stable; direct session hooks use that exact configured identity too. Federation now loads the peer's published contact snapshot when the panel opens. Selecting a local agent can add its owned, shareable domains to the connection after one clear confirmation.

SDK 11.13.7.

What's New in v11.13.5

CEREBRUM now shows the live consensus app version and makes level-3 Modify grants explicit. Overview reads CometBFT's live ABCI application version, instead of presenting a stale status-cache value after an upgrade. The domain access matrix now has Read, Write, and Modify levels, with a server-enforced permission ladder and real owner-signed level-3 grants on Save. Shared domains remain read/write-only by design; CEREBRUM rejects Modify before it can display an unenforceable permission, including dynamically shared domains.

• Safer RBAC administration. Only a local CEREBRUM operator can create an agent or change its security-critical access policy. Signed agents cannot self-elevate through the dashboard's admin/validator credentials.

• App-v20 governance compatibility. Domain reassignment and cancellation use the canonical governance proof shape once the app-v20 gate is active, while older chains retain their legacy transaction compatibility.

SDK 11.13.5.

What's New in v11.13.4

Challenges now respect corroborated knowledge, and clients can inspect the evidence instead of bypassing the API. Governed app-v21 snapshots the eligible modify holders plus current read-authorized canonical corroborators for each new challenge and requires k+1 distinct challengers when k canonical corroborators support the memory. Only a modify holder can open the dispute; snapshotted corroborators may then reverse their support by endorsing it. Zero-corroborator noise still resolves on the first authorized challenge; an eight-corroborator memory now requires nine distinct challengers.

• First-class, replay-safe challenge rounds. The electorate, threshold, round, and distinct challenge votes are AppHash-covered and committed atomically. Grant churn cannot rewrite an open round, duplicate or stale votes cannot accrue, and legacy app-v17 disputes finish under their original rules.

• Evidence is visible everywhere. REST query/search/detail, federated recall, MCP recall, and the Python SDK now return distinct corroboration_count and lifetime challenge_count values. evidence_counts_available is true only when both queries succeed and no recovery/repair-incomplete marker is present; after pristine recovery the numeric values remain useful canonical lower bounds, but a zero is not proof that no historical evidence existed. Open disputes also expose the current app-v21 round tally and threshold. Challenge and forget responses report authoritative durable post-commit status instead of assuming every challenge deprecated.

• Safe state-sync upgrade. Authorized state sync accepts app-v20 and app-v21 images, reconstructs canonical corroborator/challenger counts into a pristine serving projection as explicitly incomplete lifetime lower bounds, and pins each transfer to one exact application version. Older v20 sessions remain compatible; mismatched or unsupported images fail closed.

Caller-asserted memory type, confidence, and challenge strength are deliberately not consensus weights: they are not validator-attested facts and would otherwise let a caller self-assign immunity. Existing chains retain the exact app-v17 policy until the governed app-v21 activation. SDK 11.13.4.

What's New in v11.13.3

CEREBRUM now manages federated agent contacts by name and keeps access changes bounded to what the operator can actually see. The federation panel replaces raw 64-character agent-ID entry with the active local agent directory, then verifies the chosen identity against current shared-domain access before showing its default-off work-request switch.

• Friendly selection, exact authorization. Names, registered names, and providers are shown for humans while every request still carries the exact agent and opaque contact identities. Exact out-of-sample contacts are revalidated through a bounded background projection and disappear promptly after access, availability, agreement, or consent changes.

• Visible means visible. Access Control bulk actions now affect only the filtered domain rows on screen. Their labels say so explicitly, preventing a six-row search result from silently launching changes across the full domain catalog.

• Honest on-chain save state. Duplicate saves, mid-save agent switching, and edits to a submitted snapshot are blocked while consensus work is in flight. Partial grant failures keep retry available and are not mislabeled as saved; directory, lookup, and reconciliation failures remain actionable.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.3.

What's New in v11.13.2

This corrective release completes shared-domain federated recipient discovery at scale. v11.13.2 keeps a deterministic, valid v1 status subset compatible with v11.13.0 (at most 1,024 contacts and 1 MiB), then resolves a requested human name or exact agent address through a new authenticated, RBAC-filtered lookup route. So a shared domain can have more recipients without turning the whole snapshot or a later cache entry into a failure.

• Revocations linearize with delivery. Direct grants, organization membership/clearance, federation status, and department membership changes wait for an in-flight authorized inbox admission, claim, completion, or bounded result delivery; the next operation rebuilds the contact and rejects the old route.

• Fast, caller-safe cache. Repeated lookup of the same name is cached for one minute per signing caller. Each result retains one caller-authorized domain basis and is rechecked locally on every hit. Keyless legacy bearer tokens cannot use federated discovery or delivery as the node operator.

• No change to consent or scope. Contacts remain domain-scoped, caller-authorized, and default-off until the recipient enables that exact contact. This is still not a global directory.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.2.

What's New in v11.13.0

A shared domain can now route work to every active agent that holds current RBAC access to it—not only its owner. A level-1 reader or level-2 writer on SAGE A can opt in to receiving federated work from authorized agents on SAGE B. The existing sage_find_agent local-first lookup and short-lived, caller-scoped cache then discover those opted-in contacts by name.

• Domain-scoped, not a global directory. Contacts are exposed only through a live shared Read/Copy domain and retain that domain as their routing basis. Open-shared and ownerless domains still publish no guessed recipient.

• RBAC is rechecked at delivery. The receiver rebuilds the contact from current access grants before admitting, claiming, or completing foreign work. While a grant is revoked or expired—or an agent, owner, or federation policy changes—the old route is rejected. Inbound work remains default-off until the local operator enables that exact contact.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.13.0.

What's New in v11.12.2

Agents can now resolve a human recipient name safely across a federation. The new sage_find_agent MCP tool searches active local registrations first, then only the remote contacts already authorized for the signed caller. Its short-lived, caller-scoped in-memory projection makes repeat lookups fast without creating a global agent directory.

• Immediate, policy-safe repeat lookup. Cached remote contacts are bounded and re-authorized against current local domain access on every cache hit, so a local revoke applies to the very next lookup without a peer round trip.

• Pipeline authorization matches discovery. Federated pipe resolve and direct send both recheck the caller against the target's currently disclosed domain scope; a borrowed or stale route cannot bypass local RBAC. The outbox still requires a fresh authenticated remote contact match before payload bytes leave the SAGE.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.2.

What's New in v11.12.1

Federation now stays useful while another SAGE is slow or offline. Trusted relationships and their last-known route state render immediately from local state, initial permission and agent-contact controls no longer wait on a remote round trip, repeated status probes are shared instead of multiplied across panels, and the bounded live-status check fails promptly without hiding saved controls behind a long “Loading…” state.

• One domain surface in the Brain. The duplicate right-side Domain tags rail is consolidated into the Local/Shared Domain sources panel. Local domains can filter the MRI directly, the panel includes domain search and the compact reading guide, and remote-only domains remain visibly separate from memories actually stored on this SAGE.

• A workspace that stays where you put it. Domain sources can be moved and resized, saves its geometry across reloads, clamps itself back into the visible canvas, and includes a one-click Reset.

• Cached first paint, authenticated refresh. CEREBRUM reuses manager route diagnostics and persisted local permission state immediately, then performs one authenticated peer refresh in the background. Manual Refresh still requests fresh remote RBAC and agent-contact state.

• Native preview version alignment. The alpha shell now accepts its version-matched v11.12 daemon instead of rejecting the daemon bundled by the v11.12 release pipeline.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.1.

What's New in v11.12.0

This release makes first run, sharing, recovery, and day-to-day federation understandable without technical knowledge. CEREBRUM now presents one create-or-join decision, keeps a new SAGE private by default, explains that pairing alone shares nothing, and routes sharing into the same owner-controlled RBAC surface used everywhere else.

• File-sharing-style groups with Active Directory semantics. Owners choose already-trusted SAGEs and existing domains, guests control only their own receive role, and group deletion removes the group everywhere without deleting the trusted connections underneath it. Concurrent guest role changes are serialized by the owner, and Refresh waits for signed journal reconciliation before showing the result.

• Federation visible to ordinary agents. The read-only sage_federation MCP tool lets an authorized agent inspect the SAGE connections and Read/Copy scopes visible to its own subtree. An exact-domain sage_recall can opt into authorized peers with scope:auto, merges peer results under one global limit, preserves provenance, and falls back safely when peers use different embedding providers.

• One automatic connection path. Users no longer choose LAN versus internet. SAGE prepares direct and secure-relay candidates behind one Connect action, labels them as prepared until a real exchange selects one, prefers a working direct route, falls back without replaying a request, refreshes stale routes, and keeps route, trust, lock, compatibility, offline, degraded, and security failures distinct.

• Clear local-versus-shared visibility. Already-shared domains stay in a separate first section of the permissions list. The main Brain identifies local, remote, saved-here, and copied-from sources—even after a connection is revoked—while internal federation/RBAC audit records stay out of user memory views and sharing controls.

• Recovery that is visible and honest. Recovery-key backup acknowledgement survives reloads; a wrong recovery key is rejected before the vault is touched; successful recovery establishes the ordinary dashboard session; portable JSONL backups restore through Preview and Confirm; forgotten memories are excluded and cannot be resurrected from older backups.

• Safe same-network join. Join codes bind the exact SAGE executable as well as the version, and adopting the host chain clears only old chain-projection receipts while preserving the guest's local memories.

• Accessible, consistent controls. Destructive and privacy-affecting actions use explanatory dialogs that say what changes and what remains safe. Search filters, cleanup and preference switches, recall controls, and per-domain access switches expose useful screen-reader names.

The structured v11.12 proxy acceptance exercised first run, same-network join, three-node federation, group creation/removal, concurrent roles, restore, forgetting, cleanup, keyboard focus, and recovery on disposable nodes. The protected release workflow supplies the remaining signed/notarized clean-install artifact check.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.12.0.

What's New in v11.11.2

Sharing & Sync becomes operable at a glance. Group owners can give a group a friendly, signed name; choose one or more existing controlled domains instead of typing fragile tags; see each member's friendly name, live reachability, and catch-up state; and add an already-trusted SAGE through a guided invitation without copying a chain ID or public key. Group names ride the established signed roster manifest, so v11.11.1 peers safely ignore the optional label while continuing to synchronize during a rolling patch upgrade.

MCP reflection failures are now honest. A completely unwritable reflection returns an error, partial writes report their lost components, and degraded embedding status is preserved. Permanent domain-write ACL denials are now typed so clients do not waste a registration-and-retry cycle on a refusal that cannot succeed.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.2.

What's New in v11.11.1

Release-pipeline fix for v11.11.0. v11.11.0 was tagged but never published: the release workflow's native-shell evidence and publication jobs only execute for version 11.11 and above, so v11.11.0 was the first tag in the project's history to run them, and two latent defects surfaced in a path no pull request can exercise. The bundled daemon was staged after the Rust build that consumes it, and the publication gate expected an artifact-kind string the bundle verifier never records. Both are fixed and pinned by tests. No user received v11.11.0 on any channel.

Everything below shipped in this release.

What's New in v11.11.0

The Sharing & Sync control plane is complete, and the desktop shell foundation lands as an opt-in alpha that nothing depends on. Browser CEREBRUM remains the product; the native shell is a background track that is built and runtime-tested in CI but not distributed and not intended for end-user use.

• CEREBRUM sharing and sync controls completed. The Sharing & Sync surface finishes the control plane over synchronization groups, member roles, selective-sync state, shared domains, ownership, and catch-up position.

• Storage and task-board correctness. Postgres now enforces the same content-hash dedup parity as SQLite, so the two backends no longer disagree about what counts as a duplicate memory. The task board persists lifecycle and ordering correctly, and terminal tasks retain their original agent attribution instead of losing authorship on completion.

• Tighter local trust boundary. Acceptance endpoints are isolated from the globally configured Codex endpoint, and RBAC key caching is bounded rather than growing without limit.

• Native shell foundation (alpha, not distributed). A Tauri 2 shell starts the bundled daemon through an authenticated SSCP startup proof, owns one window with fail-closed navigation pinned to the exact authenticated loopback origin, keeps a visible recovery surface, and hands off to an existing instance on relaunch. Its installed-package lifecycle is proven on hosted runners for macOS, Windows, and Linux — install, launch, single-instance handoff, ordinary close with daemon survival, uninstall preserving the node data root, and reinstall to a genuinely new instance generation. macOS additionally proves offline startup with no external requests. Every package is unpacked and must contain exactly one bundled daemon whose embedded OS/architecture and version match the build.

• The shell does not gate releases. v11.11 distributes no native shell, so signing, notarization, update/rollback, recovery, performance, and accessibility evidence are the bar for distributing it — which the roadmap places at v12 — not a v11.11 shipping requirement. Federation, agent-to-agent messaging, and the rest of the roadmap do not queue behind desktop packaging.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.11.1.

What's New in v11.10.0

Federation now feels like connecting two colleagues' SAGE nodes, not configuring infrastructure. The reciprocal QR ceremony derives the exact listener or internet/P2P route, survives retries and rapid confirmation, and creates trust with zero implicit sharing. CEREBRUM keeps Read, Copy, Pause/Resume, and permanent revoke distinct, preserves saved choices while paused, explains peer revocation on both sides, and keeps historical connections out of the active list.

• Independent, visible sharing controls. Each operator chooses existing local domains at any time without reconnecting. Read borrows live answers; Copy requires both the source offer and the receiver's separate Save here opt-in. Long permission lists scroll cleanly, domain-owner contacts show exact agent@chain addresses plus friendly handles, and cross-host Write remains unavailable until it has connection-bound consensus authorization.

• The agent inbox crosses trusted federation edges. Existing sage_pipe work can target an explicitly visible remote agent over direct mTLS or the persisted roaming route. Receiver acceptance is default-off, payloads are marked untrusted, offline work queues durably, Pause and acceptance-off are retryable, reconnect resumes unchanged work, and delivery/result import is replay-safe and idempotent. This is agent-to-agent infrastructure—not a CEREBRUM user messaging client and not remote memory Write.

• Fail-closed ceremony and operator polish. Exact configured ports are preserved, incomplete endpoints cannot create or scan codes, internet pairing never invents a LAN fallback, double-submit is idempotent, and exact CA/operator/epoch identity still gates every action. Copy-save errors stay beside their controls; keyboard, QR, navigation, lock, and connection affordances have accessible names and clear feedback. The Python SDK also accepts legacy empty inboxes encoded as items: null.

This release changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.10.0.

Older releases

<details> <summary>v11.9.2 - colleague-style federation management</summary>

Federation now behaves like colleague sharing in CEREBRUM. JOIN establishes exact node/operator trust but shares zero domains by default. Each SAGE independently chooses and changes existing domains for live Read or optional Copy after pairing; remote Write remains explicitly unavailable until a future connection-bound consensus authorization exists.

• Connections that stay manageable. Every active row opens into clear local-versus-remote permissions, current Read/Copy state, and domain selection. Pause temporarily disconnects a colleague without losing the pairing or saved choices; Resume reconnects immediately. Permanent revoke remains available in details, not as everyday clutter, and the peer receives a durable explanation instead of a mysterious failure. Revoked history is collapsed out of the main list.

• A shorter, clearer trust ceremony. The common path is two reciprocal QR scans followed by one six-digit anti-swap fingerprint check per person. The host's redundant pre-confirmation screen is gone; peer identity and the “trust only—no domains shared” boundary now live on the single real confirmation screen. Wide layouts keep both scan cards side by side, while narrow and short screens scroll cleanly around the camera preview.

• Fail-closed under races and retries. JOIN activation, permission replacement, Pause/Resume, revocation, peer notification, stale reconciliation, and policy-label delivery are linearized against the exact CA/operator/epoch agreement generation. An old generation cannot disclose a newly built domain list, overwrite a fresh pairing, resurrect retired access, or clear a concurrent operator Pause.

This patch changes no SAGE consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. App-v20 and the v11.9 rollout boundary are unchanged; existing chains upgrade in place. SDK 11.9.2.

</details>

<details> <summary>v11.9.1 - task-marker correctness and release hardening</summary>

Task creation applies the [TASK] marker exactly once. MCP sage_task and CEREBRUM's task-creation path preserve content that is already marked instead of storing [TASK] [TASK] ...; unmarked content still receives the canonical prefix. Direct regression tests cover both entry points and both marked/unmarked inputs.

• A failed publication can be resumed only from the current protected main workflow and always checks out the exact immutable tag. The staged Python wheel smoke test installs declared runtime dependencies before importing the SDK.

• The four-validator partition proof accepts observed reject activity on either symmetric firewall endpoint while still verifying the exact peer topology on every node before, during, and after healing.

• The Go database, compression, TOML, and SQLite dependencies were refreshed through the full race and fault matrix. GitHub's Go, Node, and CodeQL actions remain pinned to immutable commits.

</details>

<details> <summary>v11.9.0 - scoped consensus and colleague-style federation</summary>

Release evidence: the exact-source make v119-state-sync cold run passed on source identity 7080580b15e7e5158a04e8b294ab772e51f294633be2737f904276afec4c3458. The branch and tag workflows independently rerun the complete race, lint, SDK/frontend, security, fault, packaging, and publication gates before exposing release artifacts.

Validator rollout boundary: install and restart the exact frozen v11.9 artifact on every participating validator before anyone broadcasts the non-empty-domain app-v20 / target-20 ceremony transaction. A merely >2/3 upgraded subset is unsafe: v11.8 does not understand the signed governance-domain tail. For operator-managed socket-mode Comet, keep recheck=true, cap max_tx_bytes at 1 MiB, and restart Comet as well so no pre-rollout oversized mempool entry survives.

Selected domains can now become canonical, recoverable quorum state inside one SAGE consensus chain. App-v20 adds exact-domain scopes whose on-chain roster and integer weights are fixed by validator governance. Each scoped memory pins its submission-time denominator, so later membership changes cannot rewrite an in-flight ballot; acceptance requires strictly greater than two-thirds of that pinned weight. Scope membership grants voting weight only—it does not grant domain ownership, RBAC, federation access, or administrator authority.

• Canonical recovery instead of projection trust. Scoped content, classification, tags, roster revisions, and ballots are AppHash-covered in Badger. A recovering replica verifies the canonical envelopes and rebuilds its discarded SQLite/PostgreSQL serving projection; /ready stays unavailable when required scoped content is missing, locked, or inconsistent.

• Authorized, boot-only network state sync. Real ABCI state-sync endpoints serve a bounded latest-visible consensus stream, never the private local rollback bundle. A strict local authorization binds the chain, existing validator/provider IDs, joining node and validator key, app version, height floor, and expiry. The effective Comet profile disables peer discovery and ordinary peer capacity, enables authenticated exact-ID filtering, and requires two distinct reachable RPC origins for light-client verification. A synchronized receiver remains a non-validator until a separate signed governance action admits its validator key.

• Crash-safe seal-before-serving. A pristine receiver verifies the candidate in isolation, activates a complete application bundle under an exclusive lease, waits for Comet's signed commit/state/block-sync handoff, durably writes the sealed activation journal, durably disarms quorum.state_sync.receiving, cleans recovery evidence, and only then publishes the runtime seal. Projection rebuild, snapshots, REST/dashboard/MCP/federation, voters, and background workers start from that final frozen bundle.

• Validator-bound governance sessions. The configured operator signs the exact REST/MCP action, while the live validator still owns the outer transaction, proposal, vote, and voting power. App-v20 binds delegated governance proofs to the target validator and a chain-derived governance domain, with deterministic freshness and single-use replay protection.

• Colleague-style sharing between independent SAGE brains. A fresh JOIN establishes exact chain/operator/CA/epoch trust and starts with zero shared domains. Each peer independently selects existing domains and can change them without pairing again: Read borrows live recall, while Copy also requires the receiver's separate “Save here” opt-in. Cross-host Write remains an authenticated 501 until it has connection-bound consensus authorization. Direct and synchronization-group traffic revalidate the exact live identity, and agreement set, JOIN activation, narrowing, and revocation are linearized so a completed change cannot leave stale access in flight.

• Crash-atomic app-v20 blocks. The one authenticated app-v20 bootstrap is isolated into a dedicated block; after its marker commits, FinalizeBlock evaluates each complete block in one speculative Badger transaction. Commit atomically persists every ordinary/governance write, validator reconfiguration, nonce, AppHash, and handshake height. A pre-Commit crash discards the whole transition, so ordinary mixed blocks replay exactly without an app-local result journal or ongoing governance-only block isolation.

• Release evidence spans real failures. The gate suite combines signed app-v20 scope formation/revision in independent OS processes, FinalizeBlock/Commit SIGKILL replay, held-replica catch-up, real four-validator Comet TCP crash/partition/heal checks, and the integrated provider/observer/unauthorized/two-receiver state-sync topology. The final exact-tree cold execution passed before the release branch was published.

This is same-chain validator replication, not a relabeling of v11.8 synchronization groups or independent-chain federation. Internet validators still need mutually routable Comet TCP, explicit port forwarding, or an operator VPN, plus reachable RPC origins. Federation is not a validator tunnel; a future tunnel layer is separate work and is not part of v11.9.0.

App-v20 remains dormant until the governed upgrade activates it, preserving byte-identical pre-activation replay. A rolling binary install is safe only while the tagged target-20 ceremony has not been submitted. SDK 11.9.0.

</details>

<details> <summary>v11.8.5 - anatomical MRI boundary</summary>

MRI memories now remain inside the anatomical cranium at every zoom and rotation. The memory cloud previously used a vertically symmetric ellipsoid even though the bundled anatomical mesh has a much shallower lower cranial boundary outside its narrow, off-centre brainstem. Lower-hemisphere nodes could therefore protrude through the mesh, especially after the v11.8.3 spread increase. CEREBRUM now uses an asymmetric vertical envelope with explicit clearance for each rendered sphere and bloom halo. The upper cortex keeps its full spread, and the newest-to-outer / oldest-to-inner age ordering is unchanged.

The placement contract is directly regression-tested across the full age, radial-jitter, and elevation range, including a fixed lower-cranium safety threshold. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.5.

</details>

<details> <summary>v11.8.4 - actionable domain write denials</summary>

Domain write denials now say what is wrong and how to fix it. When consensus rejects a memory because its authenticated agent lacks level-2 write access to an owned domain, the REST API now returns a distinct, sanitized RFC 7807 domain-write-denied problem instead of collapsing it into a generic 403. MCP preserves that machine-readable type, immediately points the agent to CEREBRUM Access Controls or the domain owner, and performs no pointless re-registration, retry loop, or /mcp reconnect suggestion. Older servers' generic denial remains on the bounded compatibility recovery path.

The built-in CEREBRUM guide also explains SAGE's token-efficiency story without pretending every session necessarily uses fewer tokens: durable context lives outside any one model and only the relevant pieces are brought back, so token spend carries useful memory instead of repeated explanations and each tool rebuilding the same history.

This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, or authorization decision; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.4.

</details>

<details> <summary>v11.8.3 - anatomical MRI memory spacing</summary>

A memory brain that uses its full anatomy while keeping age meaningful. CEREBRUM now spreads its 2,500-memory representative sample through a substantially broader portion of the MRI mesh instead of crowding long-lived histories into the centre. Fresh memories remain nearest the outer cortex; memories move progressively inward as they age, and the oldest cohort settles toward the lower inner brainstem. A one-year age window replaces the old 90-day clamp, while a small deterministic radial offset separates same-age memories without turning the stable layout into a force simulation.

The placement calculation now lives in a pure, directly tested module with bounded mesh extents and monotonic age-to-depth checks. This patch changes no consensus rule, AppHash, transaction type, key encoding, fork, graph API limit, or server workload; existing chains replay byte-identically and app version 20 remains unallocated.

SDK 11.8.3.

</details>

<details> <summary>v11.8.2 - synchronization groups and a denser MRI</summary>

Synchronization groups — human-verified, signed memory sharing between separate SAGE brains. A synchronization group coordinates memory sharing off-consensus through a partitioned, hash-chained, ed25519-signed audit journal: a roster sub-chain replicated to every member and independent per-domain sub-chains replicated only to the members who share that domain, so a node never learns of a domain it does not share. Group items are origin-signed, so a relaying peer can back-fill the mesh without being able to forge or mis-attribute them. Adding a shared domain is a two-party action — the owning member and the group controller both sign — members express selective-sync consent over the subset of domains they receive, and controller epoch rotation, member removal, and rejoin are all explicit signed roster events reconciled between peers by anti-entropy exchange.

At the time of v11.8.2, each MCP bearer minted and registered its own signing identity. Current app-v23 behavior supersedes that design: v11.18.26 binds new bearers to existing approved locally managed agents so token creation cannot strand an unapprovable identity. This release also hardens group authorization: a controller epoch rotation now re-attests the shared domain set under the incoming controller, so rotating control away from a node revokes that node's ability to admit or re-widen shared domains with its old key; and a removed or departed member cannot be silently re-activated with stale entitlements — re-entry requires a fresh, co-signed invitation. The v11.8 consensus fork gate is present but dormant.

The CEREBRUM MRI now renders a 2,500-memory representative sample instead of stopping at 500, filling large brains with a denser view while preserving a bounded GPU and API workload. The dashboard and fullscreen MRI share one limit, and operators can still tune the server ceiling with SAGE_GRAPH_MAX_NODES.

v11.8.2 is the first published build of the v11.8 line. It also clears the release lint gate and adds a replay-safety regression guard for the delegated-proof rules already committed by v11.7.6 and v11.7.7 chains. The recovery changes no production behavior beyond the reviewed v11.8 source tree apart from the denser MRI visualization.

SDK 11.8.2.

</details>

<details> <summary>v11.7.7 - one CEREBRUM tab in Firefox</summary>

One CEREBRUM tab in Firefox, including across app restarts. v11.7.7 fixes the remaining macOS launch path that could create duplicate CEREBRUM tabs. The earlier tab-focus implementation could inspect Safari and Chromium-family tabs, but Firefox exposes no equivalent AppleScript tab API; the native app also incorrectly assumed a newly started tray process could not inherit a browser tab left open by the previous process. SAGE now checks a loopback-only live-dashboard presence signal before opening a URL and activates the default browser when CEREBRUM is already connected. Initial app launch, post-update restart, dock reopen, and the Open CEREBRUM menu all use the same reuse path.

This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.7.

</details>

<details> <summary>v11.7.6 - reliable MCP turns and complete task cards</summary>

Reliable MCP turn writes and task cards that show the whole job. v11.7.6 fixes two post-app-v17 delegated-proof failures that v11.7.4 exposed after making the node authoritative for embeddings. Consensus now keeps every agent-controlled memory field bound to the exact signed request while accepting the validator-signed node's derived embedding hash, so provider cutovers no longer turn valid sage_turn observations into opaque CheckTx rejections. Fresh requests also survive the first block after a long idle period even when deterministic chain time trails the already wall-clock-validated MCP request; captured old proofs remain rejected. Public REST/MCP errors now distinguish proof mismatch and expiry from a generic request rejected.

CEREBRUM task cards stay compact by default but can expand to show complete multiline text. Planned tasks can be edited and saved without rewriting consensus history: SAGE confirms a replacement task first, then retires the original card. Existing committed blocks replay byte-identically; this patch changes only admission of requests that older binaries incorrectly rejected.

SDK 11.7.6.

</details>

<details> <summary>v11.7.5 - readable contextual help</summary>

Readable contextual help at every CEREBRUM boundary. Help tooltips now account for the nearest scroll-clipping container as well as the browser viewport, so hints near the top of Settings and other bounded panels flip downward instead of opening behind the fixed application chrome. The positioning check runs after the tooltip is rendered and keeps keyboard/focus behavior intact. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.5.

</details>

<details> <summary>v11.7.4 - provider-safe Smart Memory and CEREBRUM launch</summary>

Provider-safe Smart Memory, automatic repair, and one CEREBRUM tab. The SAGE node is now authoritative for every stored vector: it regenerates agent submissions with the selected embedding provider, stamps the exact vector space, and filters vector recall to that same space. Switching between preferred Ollama embeddings and local hash embeddings cuts write/query authority over before background migration, so active agents cannot keep a migration alive forever and recall never compares incompatible vectors. Provider recovery is watched continuously, so vectorless observations left by a transient outage repair automatically after Ollama or another configured embedder returns. New MCP clients still attach a compatibility vector for older SAGE nodes, while v11.7.4 nodes safely regenerate it.

CEREBRUM Settings now presents Ollama/hash embeddings and the independent reranker On/Off control directly, and the top status strip shows reranker state. The macOS dock app focuses an existing localhost CEREBRUM tab before opening a new one, with bounded browser automation and a safe fallback. PostgreSQL mirrors the embedding-provider provenance used by personal SQLite nodes. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.4.

</details>

<details> <summary>v11.7.3 - strict project memory, task ownership, and Settings efficiency</summary>

Strict project memory and task ownership, plus a cooler Settings page. sage_turn now treats its domain as an exact recall boundary, so one repository's session cannot be re-anchored by memories from another repository. Agent backlogs return only tasks whose assignee exactly matches the signature-verified agent ID; unassigned work stays in human CEREBRUM triage and cannot be self-claimed. Agent-created tasks are assigned to their creator, every in_progress task must have an owner, and historical ownerless running rows return to Planned on upgrade. Assignment also remains subject to the agent's domain-access policy.

CEREBRUM no longer polls health, full memory statistics, and the complete agent inventory every three seconds. Health refreshes at a calmer interval, the existing health payload supplies memory totals without a duplicate full-store scan, agents load only when Overview is visible, and all Settings polling pauses in background tabs. An RBAC save that fails on-chain now says clearly that access is not active and keeps Save enabled for an actual retry. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.3.

</details>

<details> <summary>v11.7.2 - secure background updates and CEREBRUM fixes</summary>

Background macOS updates are back, without compromising the signed app. SAGE now downloads and installs directly from the update banner, verifies the architecture-specific DMG against its published SHA-256, mounts it read-only, enforces the expected bundle identifier and Developer ID team, and asks Gatekeeper to validate both the release app and its staged copy. Activation atomically exchanges the entire signed SAGE.app bundle while preserving the previous bundle for proof-of-boot rollback. CEREBRUM also restores Access Controls, fixes Task Board page scrolling, and isolates the live block countdown so it no longer re-renders the entire Settings screen. Existing chains replay byte-identically.

SDK 11.7.2.

</details>

<details> <summary>v11.7.1 - smart-memory reliability and task-board maintenance</summary>

Smart-memory reliability and task-board maintenance release. Managed Smart Memory now stays managed: SAGE supervises the local Ollama runtime, adopts it across upgrades, and automatically restarts it after a crash instead of leaving semantic recall offline until manual repair. CEREBRUM tasks, imports, and pipeline journals now preserve embedding provenance, so newly indexed memories no longer drift back into the “needs fixing” queue after a successful repair. The task board also correctly fills the remaining application height, keeping the bottom of every column reachable. This patch changes no consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.7.1.

</details>

<details> <summary>v11.7.0 - administration, connection, and lifecycle</summary>

Administration, connection, and lifecycle release. The genesis admin can now give a locally installed agent read or read+write access to a domain another agent owns, directly from CEREBRUM: the original owner is shown before confirmation, bound into the consensus transaction, and the override is recorded as an ordinary on-chain grant/revoke. Consensus support ships behind the dormant app-v18 gate; existing chains replay byte-identically. Connecting AI tools now follows OpenAI's current product surfaces: ChatGPT desktop's Codex mode gets a one-click app-wide local connection (shared with Codex CLI and the IDE extension), while ChatGPT Work uses the hosted connector path. Restarts and updates are coordinated end-to-end: a single-instance lock, clean draining of MCP sessions and dashboard streams, checksum-verified updates with automatic rollback and proof-of-boot verification. CEREBRUM now checks for new releases automatically and shows an update banner at the top of every page, with release notes and a direct path to update or restart options. This release also fixes the v11.6.1 reports of intermittent lost MCP connections and "cannot save to domain" errors (a boot-time key cache, transport blips mislabeled as permission denials, and a keep-alive race), hardens the HTTP MCP transport (operator-only bearer principal, nonce replay cache, exact origin allowlist), and rewrites the in-app CEREBRUM guide in plain language for non-technical users.

SDK 11.7.0.

</details>

<details> <summary>v11.6.1 - security + task-handoff maintenance</summary>

Security and task-handoff maintenance release. v11.6.1 upgrades the transitive federation dependency quic-go to 0.59.1, incorporating the upstream fix for CVE-2026-40898. Assigned board tasks now reliably appear across provider boundaries, create dedicated one-way agent inbox notices, and are checked alongside backlog at agent boot. CEREBRUM also replaces browser-native confirmation prompts with accessible, themed SAGE dialogs. It changes no SAGE consensus rule, AppHash, transaction type, key encoding, or fork; existing chains replay byte-identically.

SDK 11.6.1.

</details>

<details> <summary>v11.6.0 - internet federation + controlled memory sync</summary>

SAGE federation can now travel with you, and selected memories can become a shared, durable two-node brain without turning the relay into a trusted server. v11.6.0 is an off-consensus connectivity, replication-control, and UX release: it changes no consensus rule, AppHash, transaction type, key encoding, or fork. app-v17 remains shipped-dormant until governed activation, and existing chains replay byte-identically.

• Pair across the internet without port-forwarding. Current CEREBRUM prepares direct and secure-relay candidates behind one connection flow; v11.6 introduced the bounded libp2p route bundle, NAT traversal, and Circuit Relay v2 fallback that make that possible. Federation mTLS, the pinned CA, active treaty, and signed requests remain the trust boundary; the relay sees encrypted bytes and connection metadata, never plaintext memories or federation keys.

• LAN relationships roam without re-pairing. A legacy-shaped LAN QR stays compatible with older guests. Once two v11.6 nodes finish signing, they exchange relay/direct routes over the authenticated agreement, persist them atomically, and can move LAN → internet → LAN without changing federation identity.

• Memory sync is host-controlled and off by default. After signing, the host can leave copying off or choose concrete domains permitted by both treaty scopes and local domain ownership. The selected set is the complete bidirectional replication allowlist; the guest can view it or disconnect, but cannot widen it. Existing pre-v11.6 links retain their legacy bilateral behavior until they re-pair.

• Offline catch-up keeps domain boundaries intact. The existing durable outbox and anti-entropy engine now propagate versioned host policy before data, preserve user tags, retry across restarts and outages, and catch a returning peer up. Memories outside selected domains never enter the sync outbox.

• Crash-safe no-forward provenance. A received copy is durably quarantined before its local consensus submission. Ambiguous timeouts, restarts, and revocation cannot make a foreign copy look native or leak into A→B→C forwarding; exact mirrors promote without rebroadcast, while identity mismatches fail closed.

• Federation remains opt-in. A fresh or upgraded node does not contact the project relay while federation is disabled and no persisted peer routes exist. The shipped relay is a connectivity dependency for relay-only paths, not a validator or memory store; operators can configure their own relay multiaddrs.

SDK 11.6.0.

</details>

<details> <summary>v11.5.0 - quorum-governed memory lifecycle + pipe hardening</summary>

Quorum-governed memory lifecycle plus pipe anti-DoS hardening: a two-phase challenge whose bar scales to the network, a first-class reinstate verb, disputed-but-recallable memories, and size caps and quotas on the agent pipe. v11.5.0 introduces a new consensus fork app-v17 that ships dormant - it changes no live-chain behavior until a network activates it through the governed upgrade ladder (a 2/3 quorum vote, past a 200-block floor). Until then app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay of every existing chain stays byte-identical. The pipe hardening is off-consensus and active on upgrade.

• Deprecation gates on a quorum that scales to the network (opt-in fork). When a memory is challenged, app-v17 counts the distinct modify-verb holders on its domain from committed state - the owner, ancestor-domain owners, and unexpired level-3 grantees, enumerated in sorted order. A personal node with one holder keeps the byte-identical legacy one-strike deprecate; where two or more holders exist the memory is parked as challenged, and a second, distinct holder must confirm before it deprecates - the original challenger cannot self-confirm. So a small-LAN node and a large federation apply proportionate bars instead of one hardcoded threshold.

• Reinstate is a first-class verb again (opt-in fork). A new app-v17 transaction, TxTypeMemoryReinstate, takes a challenged memory back to committed, restoring its original content hash from the challenge record; a challenger who wants to withdraw rides the same tx even if their grant has since expired or been revoked. It is reachable through REST (POST /v1/memory/{id}/reinstate), MCP (sage_reinstate), the Chrome bridge, and both Python SDK clients.

• Delegated agent proofs are action-bound on-chain (opt-in fork). When a REST node signs a transaction for a different agent, app-v17 carries the exact canonical signed request in a backward-compatible optional envelope. Consensus re-hashes and re-verifies it, reconstructs the authorized type-specific payload, applies the ±5-minute window against deterministic block time, and consumes an AppHash-folded proof marker once. A captured proof cannot be transplanted onto another action or rewrapped under a fresh node nonce. Node-originated transactions signed end-to-end by the same key keep the existing outer-signature + nonce path.

• Challenged memories stay recallable, clearly marked. A memory under a two-phase challenge is no longer hidden while the dispute resolves: recall (REST and MCP) still returns it with a new disputed flag set and a query-time confidence haircut already applied to confidence_score, so an agent sees the marker and the softened score instead of silently losing the memory.

• The agent pipe has anti-DoS guards on every write path. Pipe payloads and results are capped at 256 KiB and intents at 8 KiB at the store chokepoint, with matching 413 fast-fails in the REST and dashboard handlers. Open pipes are quota'd - 256 per verified agent identity, 10000 node-wide - checked and inserted under one write lock so a parallel burst cannot race past the cap, then rejected as 429 with Retry-After (the same backpressure recipe as a full mempool). The quota keys on the Ed25519-verified from_agent, not the spoofable rate-limit header.

• Stale pipes can't pile up. A retention backstop force-expires pending or claimed pipe rows older than 48h regardless of their stamped TTL, wired into the existing 5-minute sweep plus a new boot one-shot; terminal rows still purge 24h after creation, and the dashboard's TTL input is now clamped to 24h.

• CEREBRUM explains itself. Polished hover/focus tooltips are on by default, with detailed explanations for every sidebar destination and consistent upgrades for existing icon, status, filter, and settings hints. They stay keyboard-accessible, avoid viewport clipping, and can still be disabled under Settings → Maintenance → Preferences.

SDK 11.5.0.

</details>

<details> <summary>v11.4.11 - managed ChatGPT tunnel setup</summary>

ChatGPT setup is now a background-managed CEREBRUM flow. v11.4.11 is an off-consensus UX and packaging patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• No terminal needed for ChatGPT. The ChatGPT setup wizard now downloads the pinned OpenAI tunnel-client, writes the local profile, and starts the daemon from inside CEREBRUM. The user only opens the OpenAI and ChatGPT browser tabs.

• The generated MCP command uses the running SAGE app. CEREBRUM gets the real sage-gui executable path from the backend instead of assuming sage-gui is on PATH, so macOS app-bundle installs work.

• The tunnel client avoids SAGE's port. The managed tunnel-client admin UI binds 127.0.0.1:8081, leaving SAGE's dashboard on 127.0.0.1:8080.

• No fake secret in copyable commands. The runtime API key is accepted once to launch the child process and is not written to the profile or preferences. Advanced manual commands use an explicit placeholder, not a valid-looking sk-....

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.11.

SDK 11.4.11.

</details>

<details> <summary>v11.4.10 - join ceremony fix + MCP registry publishing</summary>

Connecting two SAGEs works again. v11.4.10 is an off-consensus bug-fix patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• The join ceremony completes. A URL-building regression in v11.4.8/v11.4.9 made the guest's "did they approve yet?" check fail silently, freezing every new connection at "1 of 2 confirmed" on both screens. The guest now sees the host's approval and the ceremony finishes.

• The wizard tells you what's wrong. If the guest can't check the host's side, the waiting screen now shows the actual reason instead of a generic network hint.

• Read-back copy is clearer. The host's "read this code" instruction now uses the other network's name.

• The public MCP registry stays current. Releases now publish SAGE's server manifest to the MCP registry automatically, and the public listing was refreshed to the current version.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.10.

SDK 11.4.10.

</details>

<details> <summary>v11.4.9 - ChatGPT via OpenAI Secure MCP Tunnel</summary>

ChatGPT setup now follows OpenAI's official Secure MCP Tunnel path. v11.4.9 is an off-consensus UX and packaging patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• ChatGPT is first-class in Connect an AI tool. The setup menu now shows ChatGPT directly instead of hiding it behind the generic remote-tool branch.

• OpenAI Secure MCP Tunnel is the ChatGPT path. The wizard gives a copyable tunnel-client runbook for SAGE's local stdio MCP server. No domain, no public SAGE URL, and no inbound firewall rule.

• Remote-tool copy is clearer. Non-ChatGPT remote tools now point to LAN/VPN or a reachable HTTPS endpoint you manage instead of mixing those cases into the ChatGPT flow.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.9.

SDK 11.4.9.

</details>

<details> <summary>v11.4.8 - join hardening + release maintenance</summary>

The join ceremony guardrails are tighter, and the release pipeline is cleaner. v11.4.8 is an off-consensus reliability and release-maintenance patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical.

• Join ceremony endpoint handling stays LAN-first. The federation join client accepts only localhost/private-LAN endpoints, canonicalizes the base URL, and re-checks the destination in the HTTP transport at dial time.

• Train-of-thought columns read cleaner. Empty MRI related-memory columns now say "None yet" instead of a placeholder dash.

• Release automation pins move in lockstep. The analysis workflow now keeps its setup and reporting steps on the same action version, avoiding mixed-version release noise.

• Patch-release metadata is current. The SDK, Docker/MCP registry metadata, dashboard fallback version, and release notes are bumped together for 11.4.8.

SDK 11.4.8.

</details>

<details> <summary>v11.4.7 - dependency refresh + release hardening</summary>

Dependencies are current, agent pipeline replies are claimant-bound, and release gates now cover the nested natter module. v11.4.7 is an off-consensus dependency and release-hardening patch - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork, app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives in dependency pins, local SQLite pipeline metadata, federation seed-at-rest handling, and CI/release automation.

• Natter dependency refresh. The nested natter Go module now carries the updated quic-go, x/crypto, and x/net dependency line, plus the matching x/* tidy updates. This keeps the optional connectivity service ready for the v11.5 internet-federation work without spending an app-version slot.

• Agent pipeline claim/result hardening. Pipeline claims now record claimed_by, and result submission is accepted only from the authenticated claimant (or a safe legacy recipient path for already-claimed pre-upgrade rows). Unrelated callers still get anti-enumeration 404s, senders can read their own pipe status but cannot complete recipient work, and failed/forged result attempts no longer create auto-journal memories.

• Federation TOTP seeds follow the vault. When a node starts with the vault already unlocked, federation TOTP seeds are wrapped at rest using that passphrase; legacy plaintext seed envelopes still load for backward compatibility. Changing the passphrase clears stale in-memory seed candidates before reload.

• Release gates now see the real tree. CI and release workflows now lint/test the nested natter module, run a cheap first-party JavaScript syntax check, and Dependabot is configured for root Go, natter, npm, the Python SDK, and GitHub Actions.

SDK 11.4.7.

</details>

<details> <summary>v11.4.6 - network name + join reliability + QR lightbox + agent grouping</summary>

Give your network a real name, connect without getting stuck, and scan a code your laptop camera can actually read. v11.4.6 is an off-consensus federation reliability + UX release - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives on the federation transport (mTLS on :8444, outside consensus), a local display table, and the dashboard.

• Name your network. Your network was only ever identified by its raw id (something like sage-personal-ybly7j6fzxp5n4zsvomjzway4w) - so when someone tried to join you, that unreadable string was all you saw. You can now give your network a friendly name (e.g. "Dhillon's MacBook") from the Federation page. Peers see it during a join - the host's review step reads "Dhillon's Mac wants to connect" - and it labels the row in each side's connections list. The name is a cosmetic label carried alongside the permanent id, which never changes: it's not used to verify anyone (the scanned/spoken code still is that anchor), and it never touches the chain.

• Joining no longer gets stuck at the last step. A guest waiting for the host's approval polls for it every couple of seconds; that legitimate polling could trip the join listener's abuse rate-limit, so the host's approval sometimes never reached the guest and the ceremony hung on "waiting for them." The rate limit now separates read-only status polling (generous) from code-submitting steps (still tight), so a normal join always completes; a stalled connection now surfaces a reason instead of spinning forever.

• A QR your webcam can lock onto. Scanning with a laptop's built-in camera pointed at another laptop across a desk was fiddly. Click the QR (or "Make it bigger") to blow it up to a full-screen, high-contrast code. The host's connection code also shows immediately now instead of behind an extra click, and the whole join flow is centered and written in plainer language.

• Arrange your agents into groups. On the Agents page you can now drag one agent onto another to group them - handy for organizing by machine or purpose - with collapsible, renamable groups. It's a local view convenience only; it changes nothing on the network.

• ChatGPT setup wizard reads straight. The "Connect to ChatGPT" wizard's callout used to point at a flow that can't list ChatGPT (OpenAI connectors need a public URL), and a mixed-content banner rendered scrambled. Both are fixed - the copy now says plainly that ChatGPT always needs the tunnel, and the banner lays out in order.

SDK 11.4.6.

</details>

<details> <summary>v11.4.5 - federation opt-in + domain-sync preview + reliability</summary>

Federation grows up: it's opt-in behind one master switch, it survives restarts and hours-long peer outages, and a topic's memories can now be copied across a link, not just borrowed live. v11.4.5 is an off-consensus reliability and federation-UX release - it changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Everything here lives on the federation transport (mTLS on :8444, outside consensus) and the dashboard; domain sync admits a copied memory as an ordinary locally-signed MemorySubmit on the receiver's own chain, so there is no new transaction and no fork.

• Federation is opt-in now, behind one switch. A fresh or upgraded node accepts no inbound connections until you turn federation on - upgrading never silently opens the :8444 port. The Federation panel gains a master On/Off switch at the top, and the same toggle stays in Settings, so the control is discoverable in both places. While it's off, the join/host cards are hidden with a nudge to turn it on; when on, the listener still only admits peers pinned to an agreement you approved (on your LAN or a route you provide).

• Domain sync (preview): copy a topic across a link, not just borrow answers. A federated connection has always let each side borrow answers live within shared topics; now you can also copy a topic's memories across so they live on both brains. It's built from a durable outbox, an anti-entropy digest that reconciles what each side is missing, and a commit-tail watcher, and it stays off until both sides turn it on for a given topic. Copied memories are admitted on the receiver as ordinary locally-signed submissions - no new transaction type, no fork.

• Federation survives being offline. A peer that goes dark for hours no longer costs you the backlog: transport and environmental errors (peer offline, not-yet-upgraded, vault locked) no longer count toward the give-up cap, so queued memories keep retrying and drain when the peer returns. The rotating-seed cache is now loaded at boot, so federation no longer stops working after a node restart. Undeliverable and rejected items surface in the dashboard with a resend control and an out-of-office-style reason, so nothing fails silently.

• A dashboard crash is fixed. The Settings page (and the new Federation panel) could hit a ReferenceError that froze the section; the shared status-dot helper is now module-scoped so both render cleanly.

• Groundwork for v11.5 internet federation. The optional natter connectivity service (a separate binary, outside the SAGE trust boundary) gains a coordinator-only mode and explicit address advertisement for cloud hosts - plumbing for the NAT-traversal/relay work that lands as the v11.5 headline. Built-in internet traversal is not in v11.4.5 yet; federation today is LAN or a route you provide.

SDK 11.4.5.

</details>

<details> <summary>v11.4.0 - search-selection "Transfer to agent" entry point for domain reassign</summary>

Handing a memory's domain to another agent is now one click from the search results themselves. v11.4.0 is a dashboard-only feature release: it changes no consensus rule, AppHash, transaction type, key-encoding, or fork - app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. The new control reuses the existing v11.3 on-chain reassignment path, so there is no new transaction and no server change.

• "Transfer to agent" from the memory selection. The Search-page bulk action bar gains a "Transfer to agent" action alongside Move, Tag, and Forget: select one or more memories, pick a new owner, and their whole RBAC domain's ownership is handed over on-chain. This complements the existing filter-row "Transfer domain ownership" button (which starts from a source agent) with a second, more direct entry point that starts from the memories you are looking at. Both drive the same honest whole-domain transfer: it moves the entire domain (every memory in it, including ones not selected), transfers ownership plus read/write access, not authorship (submitting_agent stays immutable and auditable), and the previous owner is fully revoked. When a selection spans several domains, each is transferred in turn, and the confirmation copy spells out that unselected memories move too.

SDK 11.4.0.

</details>

<details> <summary>v11.3.1 - dependency maintenance + tx-encoder overflow guard</summary>

A maintenance patch: golang.org/x/crypto is refreshed, and a latent transaction-encoding overflow is closed. v11.3.1 changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, and historical replay stays byte-identical. Both fixes sit off the consensus hot path.

• golang.org/x/crypto 0.51.0 to 0.52.0. Keeps the crypto dependency line current for the argon2 and hkdf packages SAGE actually imports.

• The transaction encoder bounds the payload length. EncodeTx now rejects a payload larger than MaxInt32 up front, so the total-length arithmetic cannot overflow and the 4-byte length prefix cannot silently truncate a pathologically oversized transaction. This mirrors the guard DecodeTx already had. No real transaction approaches this size, so behavior is unchanged for all valid traffic.

SDK 11.3.1.

</details>

<details> <summary>v11.3.0 - on-chain RBAC domain-ownership transfer + enforcing access matrix</summary>

Transferring a domain to another agent, and setting who can read and write it, are now real on-chain RBAC operations from CEREBRUM - and the access matrix finally enforces what it shows. v11.3.0 changes no consensus rule, AppHash, transaction type, key-encoding, or fork: app-v15 stays the active v11 consensus fork and app-v16 stays shipped-dormant, unchanged from v11.2.x. The RBAC domain-ownership transfer is built entirely from existing on-chain transactions - DomainReassign (tx-30), AccessGrant (tx-6), and AccessRevoke (tx-7), gated by an existing gov_propose (operation=domain_reassign) - so there is no new transaction and no new fork. There is exactly one consensus-path code change (applyGovernanceProposal now returns early for OpDomainReassign instead of falling through to validator-pubkey derivation, which logged a spurious error on every reassign), and it is proven AppHash-neutral: the caller appends a validator update only when the result is non-nil, so both the old error path and the new clean return append nothing - identical validator updates and state writes, so historical replay stays byte-identical, with only the error log gone. Memory authorship (submitting_agent) is never rewritten by any v11.3 path.

• RBAC domain-ownership transfer, on-chain from CEREBRUM. A new Search-page action "Transfer domain ownership" lets you pick a source agent, pick one of its domains, and hand it to a target agent. The historical v11.3 orchestration was all commit-confirmed: a governance proposal (domain_reassign) was accepted by the sole validator, DomainReassign flipped the owner and purged the domain's stale grants, and a redundant AccessGrant mirrored the new owner's access. App-v26 retires that trailing self-grant: canonical ownership itself gives immediate policy-limited authority, so transfer no longer depends on CEREBRUM holding the target private key. This transfers ownership and current authority, not authorship - every memory stays authored by whoever wrote it (submitting_agent is immutable and auditable), and the new owner gains access through ownership rather than by rewriting history. The old label-based "Transfer by Tag" paths, which rewrote authorship off-chain, are retired.

• The access matrix now enforces what it shows. The per-agent read/write Domain Access matrix previously wrote only a cosmetic JSON blob that the consensus access checks never read, while the tooltip claimed "enforced on every request." On Save it now issues real on-chain AccessGrant / AccessRevoke transactions (signed as the domain owner), diffed against the actual on-chain grant state so it is idempotent and self-healing. Per-domain results are reported honestly (including "you do not hold this domain owner's key" skips), and the misleading copy is corrected. No admin-bypass was added to the consensus grant/revoke handlers.

• CEREBRUM light theme plus MRI redesign. A full light-mode theme lands for the dashboard (persisted, with a sun/moon toggle), including a light-mode render of the 3D MRI memory brain. The MRI layout now places memories by recency - recent at the surface, older deeper - with a draggable, width-auto-fitting "Domain tags" side panel.

• Search date filters plus sage_rename. The Search page gains a created-at date-range filter and a "Last hour" preset. A new sage_rename MCP tool renames an agent's display name and boot bio on-chain (via AgentUpdate), failing closed to preserve the existing bio - an agent rename, not a memory or domain rename.

• The version badge reads live. The CEREBRUM version badge (header and Overview node card) now reads the live node version from /health instead of a hard-coded constant, with the fallback constant kept in sync with the release.

SDK 11.3.0.

</details>

<details> <summary>v11.2.1 - sage_turn resilient to transient Ollama embed flakiness</summary>

A reliability patch: sage_turn (and all embedding-backed recall/store) no longer fails on transient Ollama hiccups. Agents reported intermittent embed errors — the local embedder (nomic-embed-text) blipping or disconnecting "from time to time." The root cause was the embedder client: a single, unretried request with no keep_alive, so Ollama's default 5-minute idle unload meant the next embed paid a cold model reload that could time out or fail. sage_turn embeds twice (recall + store), so the flakiness hit both legs. All fixes are off-consensus — no chain, fork, or API-contract change.

• The embed model stays resident. Every embed request now sends keep_alive (default 30m, override OLLAMA_KEEP_ALIVE), so nomic-embed-text isn't unloaded between turns — eliminating the cold-reload behind most of the intermittent failures. Integer-form values (e.g. OLLAMA_KEEP_ALIVE=-1 to pin it in memory) are translated to the wire form Ollama accepts.

• Transient blips are retried; hangs fail fast. The embedder client now retries a couple of times with backoff on transient errors (connection reset, model-loading 5xx, empty result), but does not retry a timeout (a hung Ollama fails in one attempt instead of multiplying the wait) or a 4xx.

• An embedder outage never drops a sage_turn observation. If the embedder is genuinely down after retries, the memory is still committed (without a vector) rather than lost, and the turn now reports store_mode: "no_vector" + semantic_degraded: true so you know it isn't semantically recallable until a re-embed backfills the vector.

SDK 11.2.1.

</details>

<details> <summary>v11.2.0 — min_confidence decayed-floor fix + app-v16 domainless-forget remediation</summary>

Two correctness fixes: min_confidence recall now filters the value it reports, and legacy "un-forgettable" memories can be deprecated again. v11.2.0 introduces a new consensus fork app-v16 that ships dormant — it changes no live-chain behavior until operators activate it via a governance vote. The recall fix is off-consensus and active on upgrade.

• min_confidence filters the decayed confidence it reports. Recall (/v1/memory/query, /search, /hybrid, and sage_recall) filtered min_confidence against the stored confidence but returned the decayed value — so a min_confidence=0.7 query could hand back a result whose confidence_score was 0.54. The floor is now enforced on the same decayed, task-aware value that's serialized, over the full candidate set before the top-K trim (so corroboration-boosted memories aren't starved and top_k fills correctly). A new initial_confidence field exposes the stored value alongside the decayed one; open tasks are exempt from decay; federated results are re-checked against the floor.

• Legacy "no recorded domain" memories can be deprecated again (opt-in fork). Memories committed before app-v8.4 never received an on-chain domain record, so forget()/challenge() rejected them — with a cryptic error — even for their owner. The new app-v16 fork adds a governance-attested domain repair (OpMemoryDomainRepair, 2/3 supermajority) that backfills the missing domain — idempotent, existence-guarded, never overwriting — after which normal deprecation works. The deprecation gate now returns an actionable 409 (legacy, needs repair) / 404 (unknown id) / 403 (unauthorized) instead of a generic rejection, and new submits must carry a domain so the state can't recur. app-v16 activates only via a governance {Name:"app-v16", TargetAppVersion:16} upgrade — the release binary changes no consensus behavior until you vote it in.

SDK 11.2.0.

</details>

<details> <summary>v11.1.0 — cross-node federation fix + health/observability polish</summary>

Historical v11.1 release note. v11.1.0 introduced a startup network-identity re-mint for legacy nodes. That mechanism is retired and disabled in v11.16.1 because it reset canonical history.

Safety update (v11.16.1): the automatic legacy re-mint described in this historical release note is disabled. It deleted canonical Badger/CometBFT history and SQLite cannot reconstruct that authority. Legacy ids now remain unchanged until a history-preserving governed migration exists.

• Historical v11.1 behavior (retired in v11.16.1). v11.1 attempted to replace the shared pre-v11 sage-personal network id during startup. That mechanism reset canonical history and is now disabled. Affected legacy ids remain unchanged until a governed, history-preserving migration exists.

• Turning on encryption is discoverable. The System Status "Synaptic Ledger Encryption" row now has an inline Enable → button (opens Settings → Security), instead of a dead-end "Off".

• Idle chains are explained. A new operator doc (concepts/block-production-and-idle.md) makes clear that a SAGE chain has no heartbeat — an idle chain mints no blocks, and a frozen height with an empty mempool is healthy, not stuck. /v1/dashboard/health now exposes chain.idle / chain.stuck / last_block_age_seconds so monitors alert on stuck, not a still height.

• Embedding health is visible. GET /ready now reflects the embedding provider: a down semantic embedder reports degraded (HTTP 200; ?strict=1 → 503) instead of a misleading ready, refreshed by a background watchdog. And sage_recall / sage_turn results carry recall_mode / semantic_degraded / degraded_reason so an agent knows when recall silently fell back to keyword-only.

• Mempool backpressure signals. New GET /v1/chain/backpressure (+ an X-Sage-Mempool-Pct header on every submit) lets clients pace writes without polling raw CometBFT RPC, and a mempool-full submit returns 429 + Retry-After (a distinct problem type) instead of an opaque 500.

• Guaranteed auto-commit is operable. --require-voter / voter.required makes a deployment that needs automatic proposed → committed flow fail-fast rather than silently run voterless; sage_voter_running + sage_proposed_oldest_age_seconds metrics and a /ready voter block turn a stuck backlog into a first-class alarm; a new concepts/voter-operations.md runbook covers per-mode ownership, key safety, quorum math, and triage.

• Safer upgrades + hardened archive extraction. The pre-upgrade backup is verified by content (integrity + memory row-count parity) rather than file size, and an un-checkpointable write-ahead log aborts the migration instead of being discarded. Archive extraction for the managed Ollama runtime now validates symlink/hardlink targets against the extract root.

SDK 11.1.0.

</details>

<details> <summary>v11.0.2 — managed Ollama setup + docs polish</summary>

Smart memory setup now manages Ollama end to end. v11.0.2 is a patch release on top of v11.0.1: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; app-v15 remains the active v11 consensus fork.

• Managed Ollama runtime for semantic memory. The CEREBRUM smart-memory wizard can now install a pinned Ollama runtime, start/adopt the local sidecar, pull nomic-embed-text, verify the embedding dimension, and remember the managed runtime preference across restarts. This gives Ollama the same dashboard-first setup path as the managed reranker.

• Setup endpoints are wizard-gated. The new install/start/pull routes run behind the dashboard setup security gate, and archive extraction refuses traversal, oversized payloads, incomplete downloads, and checksum mismatches before anything becomes active.

• Trust and deployment wording is clearer. The public Security FAQ now separates SAGE Personal from Enterprise threat models, calls out local BadgerDB/SQLite storage accurately, and tightens the GitHub Pages privacy copy so optional connector traffic is not confused with a SAGE-hosted relay.

• Docs stay current with v11 code truth. The reference docs, benchmark READMEs, SDK README, roadmap, and environment-variable notes are updated for the v11.0.2 surface without changing consensus semantics.

SDK 11.0.2.

</details>

<details> <summary>v11.0.1 — MRI-first CEREBRUM polish + dependency update</summary>

CEREBRUM is now fully MRI-first. v11.0.1 is a launch-polish patch on top of v11.0.0: no consensus rule, AppHash, transaction, key-encoding, or migration change. Existing v11 chains update in place; app-v15 remains the active v11 consensus fork.

• MRI is the CEREBRUM view. The legacy 2D brain option is no longer exposed in the dashboard. CEREBRUM opens directly into the 3D MRI memory brain, with the same offline three.js / 3d-force-graph bundle and anatomical mesh fallback path.

• Focused memories are clearer and easier to leave. Clicking a memory brings it into focus with a visible white focus ring, and clicking open space exits the focused train-of-thought view back to all memories.

• Launch visuals now match the product. The README leads with the real MRI brain screenshot, and the supporting screenshots are tracked with the docs so GitHub, package archives, and release pages show the correct launch surface.

• Federation wording is tightened. v11.0 federation is LAN-first, or reachable over a VPN/tunnel/operator-provided route. First-class internet/NAT traversal remains scoped for v11.5.

• Dependency update. golang.org/x/net is bumped to v0.55.0 in the Go module graph.

• Docs and SDK metadata are lockstep. The Python SDK version, reference headers, roadmap status, and MCP/Docker registry metadata are bumped to 11.0.1.

SDK 11.0.1.

</details>

<details> <summary>v11.0.0 — CEREBRUM, managed reranker, federation join ceremony</summary>

CEREBRUM becomes a real control board, semantic memory turns on in a few clicks, one click stands up a managed reranker, and two SAGE nodes can now federate their memory over a secure LAN-first join ceremony. v11.0.0 activates a new app-v15 consensus fork and ships as a major version: every validator must run this binary and fully converge before the app-v15 activation height (the auto-vote readiness gate enforces this on the governance path, so an unsupported upgrade never reaches quorum). Every existing chain replays byte-identically until activation (the fork gate is dormant pre-activation), and a node-by-node rolling upgrade is safe: a mixed v10.x / v11.0.0 cluster computes the identical AppHash while app-v15 is dormant. On personal/single-validator nodes the auto-advance ladder reaches app-v15 automatically.

• CEREBRUM dashboard overhaul. A new top-level Overview control board gives you a glanceable, read-only picture of the node: a status banner plus cards for chain health, quorum and nodes, agents, federation, and embeddings, each polling independently so one dead feed never blanks the board. The 3D MRI brain is now the default view, and it renders fully offline (three.js and 3d-force-graph are bundled locally instead of pulled from a CDN); established memories pull to the core and fresh ones ride to the rim, and clicking a memory blooms its "train of thought" as a labelled constellation with a side panel you can hop through. Search is real full-text plus semantic now (FTS5, relevance-ranked, RBAC-scoped) instead of a client-side filter over the newest 100, with status filters (all / committed / proposed / deprecated), corroboration counts, an editable memory domain, and bulk curation (multi-select with an action bar). A live Tasks board shows agent-vs-human authorship, supports drag-to-status, and uses an atomic compare-and-swap claim so two agents never double-work an assignment, and a Messages tab (the agent-to-agent pipeline, merged into Tasks) adds a human-to-agent note composer so a person can drop a note into an agent's inbox without impersonating one. A first-run onboarding wizard (welcome, semantic memory, connect an AI tool, pointers) shows only on a fresh node and is re-runnable any time from Settings > Maintenance > Run setup.

• Semantic memory made effortless. A "Turn on smart memory" flow switches the node off the keyword-only hash pseudo-embedder onto the bundled Ollama + nomic-embed-text (768-dim): it detects Ollama, downloads the model if missing, re-embeds your existing memories with a live progress bar (resumable, vault-gated, runs in the background), then restarts so every consumer picks it up. Memories orphaned by a past vault re-initialization (encrypted under a previous data key and undecryptable now) can be recovered by re-keying in place: paste the old recovery key, preview "X of N", and recover, with no new IDs and no new consensus records, since only content and embedding are encrypted while the content hash stays plaintext-derived. Deprecated memories are now audit-only and never surface in CEREBRUM.

• One-click managed reranker. SAGE gives the reranker the Ollama treatment: with one consent click it downloads a pinned llama.cpp release build itself (sha256-verified before any byte touches disk) and the bge-reranker-v2-m3 GGUF (Q8_0, 636MB, sha256-verified, atomic install so a truncated or tampered file never lands), then spawns and manages a llama-server sidecar on loopback that serves a real cross-encoder /v1/rerank. It survives node restarts (a healthy survivor is adopted via a real rerank probe rather than blindly respawned, with a probe-before-kill guard on shutdown). The whole thing is a zero-terminal hands-off checklist (engine, model, start, done), and recall k is now tunable from 3 to 20 (was 4 to 10) with copy that explains the token cost and flips its guidance based on whether the reranker is actually on.

• Federation v2. Two SAGE nodes can now share memory on the same LAN, or over connectivity you explicitly provide, established through a secure join ceremony. First-class internet/NAT traversal is scoped for v11.5, not v11.0. The v11 ceremony uses RFC-6238 TOTP-based mutual verification with a QR enrollment plus spoken 6-digit confirm codes, a pin-bound short-authentication-string that provably diverges if an enrollment is relayed, and a fail-closed version gate. Two modes, both consent-gated with a "nothing is deleted" guarantee: exchange mode keeps foreign data on its owner's chain and queries it live off-consensus over a pinned mTLS federation listener and query proxy, and co-commit mode writes native memories on both chains, each ratified by its own chain and cross-anchored by a hash of the other side's signed commit receipt (you remember and I remember, each on our own chain). Guided guest and host wizards make "add another computer to my SAGE network" an end-to-end dashboard flow.

• app-v15 consensus fork. The fork that makes federation v2 real on-chain: new co-commit transaction types (CoCommitSubmit / CoCommitAttest) and cross-federation exchange-terms types (set / revoke), a co-commit envelope validity window bound to jointly-signed times and to federation status, and an access-grant verb ladder that makes the level-3 "modify" verb grantable and requestable. It also tightens the authorization gates on existing consensus handlers as a hardening pass. Every one of these rules derives purely from committed state and the consensus block time (no wall clock, no per-node cache, no map-iteration order), so every replica reaches the same verdict; all of it is byte-identical pre-activation and reached through the same governed upgrade ladder every prior fork uses (auto-advanced on personal nodes, governance-activated on a quorum).

• Quality. New memories now stamp their embedding provider at insert, so a freshly-written memory stops posing as unembedded and the "needs re-reading" counter no longer creeps up forever over real vectors. Redeploy got a robustness pass: a single-validator agent add/remove no longer runs the destructive wipe-and-restart that could brick a personal node, a stuck "reconfiguration in progress" banner can no longer wedge forever, and redeploy status reports the real terminal outcome instead of flashing a false success. Underneath it all are dozens of fixes from multi-pass adversarial find-and-verify reviews across the consensus, transport, web, frontend, and crypto surfaces.

SDK 11.0.0.

</details>

<details> <summary>v10.9.1 and earlier — full per-version changelog on the <a href="https://github.com/l33tdawg/sage/releases">Releases page</a></summary>

The v10.x line (MRI 3D brain, the app-v12/v13/v14 idle-block + AppHash fork ladder, multi-node-safe voting, per-domain read-ACLs) and the full v3–v9 history — consensus-first writes, PoE-weighted quorum, governance-gated upgrades, TLS, RBAC/multi-org, hybrid recall — are on the Releases page.

</details>

</details>

Research

Documentation

Stack

Go / CometBFT v0.38 / chi / BadgerDB / SQLite or PostgreSQL + pgvector / Ed25519 + AES-256-GCM + Argon2id / MCP

License

Unless otherwise stated, SAGE source code is licensed under Apache 2.0. Papers: CC BY 4.0. Some bundled visual assets are third-party works under their own licenses (e.g. the 3D MRI brain mesh, CC BY 4.0) — see THIRD_PARTY_NOTICES.md.

Author

Dhillon Andrew Kannabhiran (@l33tdawg)

SAGE Foundation

<p align="center"><em>A tribute to <a href="http://phenoelit.darklab.org/fx.html">Felix 'FX' Lindner</a> — who showed us <b>how much further curiosity can go.</b></em></p>