{
"markdown": "# (S)AGE — Sovereign Agent Governed Experience\n\n**Persistent, consensus-validated memory infrastructure for AI agents.**\n\nSAGE gives AI agents institutional memory that persists across conversations, goes through BFT consensus validation, carries confidence scores, and decays naturally over time. Not a flat file. Not a vector DB bolted onto a chat app. Infrastructure — built on the same consensus primitives as distributed ledgers.\n\nThe architecture is described in [Paper 1: Agent Memory Infrastructure](papers/Paper1%20-%20Agent%20Memory%20Infrastructure%20-%20Byzantine-Resilient%20Institutional%20Memory%20for%20Multi-Agent%20Systems.pdf).\n\n> **Just want to install it?** [Download here](https://l33tdawg.github.io/sage/) — double-click, done. Works with any AI.\n\n[Quick Start](#quick-start) · [Architecture](#architecture) ·\n[Capabilities](#current-capabilities) · [Dashboard](#cerebrum-dashboard) ·\n[Release history](#release-history) · [Documentation](#documentation)\n\n\n ![\"(S)AGE](\"https://glama.ai/mcp/servers/l33tdawg/s-age/badge\")
\n\n\n---\n\n## Quick Start\n\n**Desktop:** [Download the latest release](https://github.com/l33tdawg/sage/releases/latest),\nopen SAGE, then use CEREBRUM to connect your AI. For a full walkthrough, see\n[Getting Started](docs/GETTING_STARTED.md).\n\n**From source (Go 1.25.13+):**\n\n```bash\ngit clone https://github.com/l33tdawg/sage.git && cd sage\ngo build -o sage-gui ./cmd/sage-gui/\n./sage-gui setup # Pick your AI, get MCP config\n./sage-gui serve # SAGE + Dashboard on :8080\n```\n\nOr grab a binary: [macOS DMG](https://github.com/l33tdawg/sage/releases/latest) (signed & notarized) | [Windows EXE](https://github.com/l33tdawg/sage/releases/latest) | [Linux tar.gz](https://github.com/l33tdawg/sage/releases/latest)\n\n\nDocker and containerized MCP setup
\n\n### Docker\n\n```bash\ndocker pull ghcr.io/l33tdawg/sage:latest\ndocker run -d --name sage \\\n -p 8080:8080 \\\n -v ~/.sage:/root/.sage \\\n ghcr.io/l33tdawg/sage:latest\n```\n\nPin a specific version with `ghcr.io/l33tdawg/sage:11.19.18`.\n\nThe SAGE server stays in that container. To give a local MCP client a stdio\nbridge, start a second process **inside the same running container**:\n\n```bash\ndocker exec -i \\\n -e SAGE_PROVIDER=claude-code \\\n -e SAGE_PROJECT=my-project \\\n -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \\\n sage /usr/local/bin/sage-gui mcp\n```\n\nFor the shipped Compose stack, use the service name rather than a generated\ncontainer name:\n\n```bash\ndocker compose -f docker-compose.sage-gui.yml exec -T \\\n -e SAGE_PROVIDER=claude-code \\\n -e SAGE_PROJECT=my-project \\\n -e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \\\n sage /usr/local/bin/sage-gui mcp\n```\n\nIf an MCP client launches this through a wrapper, point its stdio configuration\nat the wrapper's absolute path. Pass `SAGE_PROVIDER`, `SAGE_PROJECT`, and\n`SAGE_IDENTITY_PATH` through `docker exec -e`/`docker compose exec -e`; setting\nthem only on the host-side Docker command does not place them in the container.\nKeep the whole SAGE data root mounted at `/root/.sage`, including agent keys and\nthe ledger. Do not start a separate `docker run ... mcp` container: its\n`localhost:8080` is isolated from the running SAGE server.\n\nHTTP MCP is also available at `/v1/mcp/sse` and `/v1/mcp/streamable`, but both\nrequire a bearer token or OAuth. Bare `http://localhost:8080` is the REST base,\nnot an unauthenticated MCP endpoint.\n\n \n\n\nUpgrading an existing node
\n\n### Upgrading from an older version?\n\n**Upgrading an existing node — including the v10.x → v11 jump — is\n[docs/UPGRADING.md](docs/UPGRADING.md).** In the desktop app, accept the update:\nSAGE verifies canonical upgrade compatibility, captures a full recovery\nsnapshot, installs, and restarts automatically. Headless and quorum operators\nhave separate technical procedures in the guide.\nYour chain advances in place; a personal node climbs the consensus fork ladder by\nitself. Read the guide before a multi-admin chain crosses app-v23 — that\nactivation re-derives administrator authority.\n\nIf you installed SAGE before v5.0 and your AI isn't doing turn-by-turn memory updates, re-run the installer in your project directory:\n\n```bash\ncd /path/to/your/project\nsage-gui mcp install\n```\n\nThis installs Claude Code hooks that prompt the memory lifecycle (boot, turn, reflect) — even if your `.mcp.json` is already configured. Restart your Claude Code session after running this.\n\n \n\n---\n\n## Architecture\n\n```mermaid\nflowchart TB\n A[\"AI agents · MCP / SDK / REST\"] --> P[\"SAGE node · authenticated admission + live policy\"]\n H[\"CEREBRUM · local human control\"] --> P\n P --> M[\"Memory + local policy transactions
CometBFT / ABCI\"]\n P --> W[\"Node-local coordination
inbox / claims / replies\"]\n M --> B[\"BadgerDB
authoritative chain state\"]\n B --> Q[\"Commit-time SQL projection
content + vectors for authorized recall\"]\n P -. \"explicit peer trust and sharing\" .-> F[\"Separate SAGE chain
bounded Read / receiver-controlled Copy\"]\n classDef entry fill:#eef2ff,stroke:#6366f1,color:#1e293b\n classDef memory fill:#ecfdf5,stroke:#059669,color:#064e3b\n classDef work fill:#fff7ed,stroke:#d97706,color:#7c2d12\n class A,H,P entry\n class M,B,Q memory\n class W,F work\n```\n\n**Agents are not validators.** Personal mode runs one real CometBFT validator\nwith a per-node memory auto-voter; it has no Byzantine redundancy. Registering\nmore agents does not add consensus voters. A multi-validator deployment runs\none shared chain; federation connects separate chains under explicit policy.\n\n**Storage has two roles.** BadgerDB is authoritative for consensus state.\nSQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content\nand vectors at Commit. Node-local message coordination is separate from the\nmemory consensus path. Block inclusion is not the same as memory acceptance.\n\nFor the detailed trust boundaries, lifecycles, and deployment topology, see\n[Architecture & Deployment](docs/ARCHITECTURE.md).\n\n## Current Capabilities\n\n| Capability | What it provides |\n|------------|------------------|\n| Governed memory | Persistent, attributed memories with consensus validation, semantic recall, confidence, and lifecycle controls |\n| Durable tasks | Exact-agent assigned backlog; open tasks do not decay; idempotent creation and workflow status |\n| Unified inbox | Local/federated requests, assignment notices, and a separate passive reply page |\n| Runtime handoff | Explicit session-and-revision-fenced takeover of claimed work within the same signed agent identity |\n| Access controls | Active enrollment, roles/profiles, ownership, Access Groups, compatible grants, and classification checks |\n| Controlled federation | Explicit agent exports and bounded Read/Copy policy, without granting local membership or Write |\n| Recovery and updates | In-place chain upgrades, recovery snapshots, and retained message claims across ordinary restarts |\n\n### How agents collaborate\n\n```mermaid\nflowchart TB\n T[\"Task assigned to exact agent\"] --> N[\"One-way assignment notice\"]\n N --> I[\"Unified inbox\"]\n R[\"Request addressed to exact agent\"] --> I\n I -->|\"task notice\"| V[\"Verify current assignment in backlog
then update the task\"]\n I -->|\"inbound request\"| C[\"Claimed by one MCP runtime\"]\n C -->|\"normal completion\"| O[\"Idempotent reply\"]\n C -. \"intentional same-agent takeover\" .-> H[\"Handoff: expected session + revision\"]\n H --> O\n O --> S[\"Original sender reads reply_items
or pages retained replies\"]\n classDef input fill:#eef2ff,stroke:#6366f1,color:#1e293b\n classDef task fill:#ecfdf5,stroke:#059669,color:#064e3b\n classDef message fill:#fff7ed,stroke:#d97706,color:#7c2d12\n class I input\n class T,N,V task\n class R,C,H,O,S message\n```\n\nAssignment, claim, and reply are different states. A task notice is not a\nrequest for a message result, and a reply is not a new assignment. Runtime\nhandoff does not reassign a task to another agent. Wake notifications are\npayload-free hints, not delivery or claim evidence. Every agent request and\nresult remains untrusted data, not authority to expand the user's instructions.\n\nSee the [MCP task/inbox reference](docs/reference/mcp-tools.md) and\n[message/reply lifecycle](docs/reference/concepts/message-reply-lifecycle.md)\nfor exact fields, recovery, and authorization rules.\n\n---\n\n## CEREBRUM Dashboard\n\n\n\n`http://localhost:8080/ui/` — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.\n\n| Control Board | Federation | Recall Engine |\n|:---:|:---:|:---:|\n|  |  |  |\n| Chain health, quorum, agents, federation, and embeddings | One trust-only JOIN that prepares Direct and Secure relay automatically, followed by independent Read/Copy choices on each SAGE | Smart-memory setup, managed reranker install, and recall-depth tuning |\n\nThe dashboard also includes governed agent enrollment, Access Groups, domain\npermissions, separate CEREBRUM Root credential handover, import/export,\nsoftware updates, and encryption controls. Ordinary agent identity replacement\nuses re-enrollment; historical memory authorship is preserved.\n\n---\n\n## What's New in v11.19.18\n\nFederation agents now visibly orbit their nodes. Motion continues over empty map space and resumes after pointer selection; hovering an agent, keyboard inspection, and dragging keep targets steady. Pause motion and reduced-motion preferences remain supported.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.18`. SDK 11.19.18.\n\n## What's New in v11.19.17\n\n**See your federation.** CEREBRUM opens connected nodes as an interactive\nconnectome with agent clusters, search, zoom, a List view, and a selection panel\nfor exact addresses and connection controls. Gentle ambient agent drift includes\na pause toggle, stops during interaction, and respects reduced-motion settings.\nActual node names make the viewed\nnode clear, including when you open another SAGE through a tunnel.\n\nA dedicated operator-only SSE stream shows recent message and reply transport\nstatus without exposing message text or proofs. Live changes animate when their\nendpoints are loaded; reconnecting refreshes history without replaying old\ntraffic. The view is bounded, with explicit agent and node paging.\n\nFederation onboarding now explains **Exchange codes → Verify together → Explore\nagents**. Both confirmation screens preserve the explicit number check and\nexplain that memory sharing is optional. Read, Copy, and Clear domain permissions accept\nbulk selection or drag-and-drop into a draft, with an explicit save. Removing\ntrust keeps its separate confirmation and pairing-again explanation.\n\nNo consensus-rule or application-version change; app-v27 remains the ceiling.\nExisting permissions and trust agreements stay in place.\nContainer: `ghcr.io/l33tdawg/sage:11.19.17`. SDK 11.19.17.\n\n## What's New in v11.19.16\n\n**Connect nodes, find agents, send messages.** Trusted peers running v11.19.16\nmake eligible ordinary agents discoverable and messageable automatically, without\nexporting each agent or granting access to memory domains. Root identities stay\nexcluded, and explicit messaging blocks still apply.\n\nCEREBRUM adds a searchable directory grouped by node, exact-address copying, and\npaged agent lists. Bulk selection and drag-and-drop prepare Read/Copy sharing\nchoices; saving those choices explicitly grants memory access. Pairing alone\nshares no memory domains, and existing approved grants remain in place.\n\nMCP `sage_directory` searches local and federated agents by default. Upgrade both\npeers for automatic node messaging; older peers retain their export-based behavior.\nNew sends refresh legacy recipient tickets, while queued messages retain their\noriginal authorization mode.\n\nFederated replies now accept the signed claimant-session field emitted by MCP,\nfixing peer rejection of otherwise valid replies. Reply retries report the actual\nretained delivery state and diagnostic instead of always claiming \"queued\".\nExisting failed events remain failed; the upgrade does not silently resend them.\n\nNo consensus-rule or application-version change; app-v27 remains the ceiling.\nContainer: `ghcr.io/l33tdawg/sage:11.19.16`. SDK 11.19.16.\n\n## What's New in v11.19.15\n\n**Consensus-safe memory cleanup, without the 500-record cap.** CEREBRUM now\nscans the full inventory, previews verified eligible counts, and processes\nmanual or automatic cleanup through existing consensus challenge transactions.\nOpen tasks and internal records are protected. The UI distinguishes queued work,\nconfirmed submissions, and observed outcomes instead of reporting premature success.\n\nAutomatic cleanup requires **fresh current-Root authorization after upgrading**;\nold enabled toggles do not silently activate it. Preview does not enable cleanup.\nExact signed transactions are saved before submission for safe recovery. A\nchallenge may need further votes; audit history is retained. See the\n[cleanup guide](docs/reference/concepts/memory-cleanup.md).\n\nNo consensus-rule or application-version change; app-v27 remains the ceiling.\nContainer: `ghcr.io/l33tdawg/sage:11.19.15`. SDK 11.19.15.\n\n## What's New in v11.19.14\n\n**Security dependency update:** gRPC-Go is upgraded to v1.83.1 to address\nHTTP/2 DATA-frame fragmentation heap exhaustion (CVE-2026-84304, Dependabot\nalert #45). The required genproto and OpenTelemetry dependencies are refreshed\nalongside it. CodeQL workflow actions are pinned to the verified v4.37.9 commit.\n\nThis patch introduces no consensus-rule, AppHash-input, key-encoding, fork-target,\nor application-version changes. App-v27 remains the supported ceiling.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.14`. SDK 11.19.14.\n\n## What's New in v11.19.13\n\n**The stdio MCP bridge no longer self-installs project hooks into the user’s\nhome directory.** When `sage-gui mcp` starts with `$HOME` as its working\ndirectory, automatic project repair now returns without writing `.claude`\nhooks or project-relative hook registrations into user-global configuration.\n\nExplicit `sage-gui mcp install` and `sage-gui codex install` commands keep their\nexisting home-directory refusal. Normal project-directory self-healing also\nremains unchanged, including when `CLAUDE_CONFIG_DIR` points elsewhere.\n\nThis patch changes no consensus rule, AppHash input, key encoding, fork target,\nor application version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.13`. SDK 11.19.13.\n\n## Release History\n\nThe latest release notes are above. Earlier entries below describe behavior at\ntheir release dates; use the current reference for present-day contracts.\n\n\nEarlier releases — preserved changelog
\n\n## What's New in v11.19.12\n\n**Project-scoped MCP and Codex installs can no longer corrupt user-global host\nconfiguration.** `sage-gui mcp install` and `sage-gui codex install` now refuse\nto run when the working directory resolves to the user's home directory. Run\nthe command from the intended project instead; ordinary project installs are\nunchanged.\n\nThe native-shell build also refreshes its fail-closed checksum for the official\nSeptember `linuxdeploy-plugin-appimage` rebuild. The replacement was produced\nby the upstream project's successful scheduled workflow from its unchanged\nsource commit, and its downloaded SHA-256 matches GitHub's release-asset\ndigest. An unexpected future replacement will continue to stop the build.\n\nThis patch changes no consensus rule, AppHash input, key encoding, fork target,\nor application version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.12`. SDK 11.19.12.\n\n## What's New in v11.19.11\n\n**CEREBRUM now supports operator-configured hostnames behind a local TLS\nreverse proxy.** Set `SAGE_ALLOWED_CEREBRUM_HOSTS` to an exact comma-separated\nhostname allowlist when Caddy, Traefik, or another loopback proxy preserves the\nbrowser-facing `Host` instead of rewriting it to `localhost`. Ports are\nnormalized and wildcards are deliberately unsupported.\n\nThe trust boundary stays local: the connected peer and every forwarded IP hop\nmust still be loopback, unconfigured hostnames still fail closed, and browser\norigin matching accepts `X-Forwarded-Proto` only when every field-line and\ncomma-joined token is a valid, case-insensitive `http` or `https` value and all\nhops agree. Empty, malformed, or mixed scheme chains are rejected.\n\nThis patch changes no consensus rule, AppHash input, key encoding, fork target,\nor application version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.11`. SDK 11.19.11.\n\n## What's New in v11.19.10\n\n**Returning agents can be reviewed normally again.** When app-v26 retirement\nhas handed an agent's former home domain to the stable Root principal,\nCEREBRUM reapproval now binds the existing owner and uses the established\nRoot-to-agent recovery transfer for that exact recorded home. Fresh or\noperator-entered domains never receive an implicit transfer.\n\nRejecting a pending registration now counts active memories—the same lifecycle\nview shown by the recovery panel—instead of treating deprecated audit history\nas work the operator can still remediate. Active records continue to block\nordinary rejection unless they are deprecated, transferred, or the explicit\nattribution-preserving force path is chosen.\n\nThis patch changes no consensus rule, AppHash input, key encoding, fork target,\nor application version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.10`. SDK 11.19.10.\n\n## What's New in v11.19.9\n\n**Codex workspace identity resolution now fails closed at the filesystem\nroot.** A user-level Codex MCP process launched from `/` can no longer reuse the\nretired `global-codex` signer or auto-register the synthetic name `codex//`.\nSAGE rejects that broad, untrustworthy boundary before Git discovery,\nproject-config lookup, key loading, or key generation. Real project and linked\nworktree roots continue to resolve to their stable workspace identities;\noperators who intentionally need a non-workspace shared identity must pin it\nexplicitly with `SAGE_IDENTITY_PATH`.\n\nThis patch changes no transaction, AppHash input, key encoding, fork target, or\napplication version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.9`. SDK 11.19.9.\n\n## What's New in v11.19.8\n\n**Access Groups now discover transferred historical domains, not only each\nmember's enrollment-time home domain.** CEREBRUM's bounded caller-domain\nprojection consults the consensus-maintained current-owner index for the caller\nand active local group peers. A transferred `user-*` domain therefore appears\nas a usable exact recall or write target even when its current owner never\nauthored a memory there.\n\nEvery discovered candidate is still re-authorized against current ownership,\ngroup authority, profile restrictions, and hard denies before it is returned.\nPer-record classification checks remain on the memory disclosure path. The\nresult remains bounded and explicitly reports truncation; it does\nnot expose a global domain roster, change ownership, copy grants, or weaken\nshared-domain and foreign-write restrictions.\n\nThis patch changes no transaction, AppHash input, key encoding, fork target, or\napplication version. Existing app-v27 chains replay byte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.8`. SDK 11.19.8.\n\n## What's New in v11.19.5\n\n**Claim recovery and host wake coordination now survive real multi-transport\nruntimes.** Both exact-local compatibility claim paths—`GET /v1/pipe/inbox`\nand explicit `PUT /v1/pipe/{pipe_id}/claim`—atomically bind the session and\ncreate its receipt, so ownership cannot commit without recovery evidence. MCP\nclaimant identities are durable and transport-scoped across stdio,\nStreamable HTTP, and SSE; `claimant_identity_mode` discloses whether the\nidentity is durable, a safe concurrent ephemeral fallback, inherited, or\nunavailable.\n\nClaim transfer remains deliberate. `sage_message_handoff` requires the exact\n`claimant_session_id` and `claim_revision` returned by passive history; stale\nor A→B→A delayed transfers fail the revisioned compare-and-swap fence. The\ndirect REST route preserves pre-v11.19.5 clients by treating an omitted\n`from_revision` as 0 only, so it can move an untouched first-generation claim\nbut safely conflicts after any transfer. SAGE never steals a claim merely\nbecause it is old.\n\nThe new signed, payload-free `GET /v1/inbox/activity-state` returns exactly\n`{version,epoch,seq}` so host hooks can notice fresh task assignments and\nreplies. The opaque 32-character database-incarnation `epoch` survives process\nrestarts and backup restore, but changes for a fresh database so an old host\ncursor cannot suppress new cues after reinitialization.\nThose events remain nonblocking coordination: they do not change the exact\nthree-field `{version,seq,pending}` contract of `/v1/messages/wake` or\n`/v1/messages/wake-state`, and they never make Stop treat a reply as unfinished\nwork. Hooks can surface activity on the next prompt, but cannot resurrect an\nalready-idle host task.\n\nThis patch changes no consensus rule, AppHash input, transaction type, key\nencoding, fork target, or application version. The supported consensus ceiling\nremains app-v27.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.5`. SDK 11.19.5.\n\n## What's New in v11.19.4\n\n**Updater governance compatibility and recovery state are now one atomic\nproof.** The replacement binary reports its own maximum supported application\nversion. SAGE validates canonical pending-plan and active-ballot state against\nthat exact ceiling while holding the same runtime read fence that pins the\nsnapshot height and AppHash. Consensus cannot publish newer governance state\nbetween the compatibility decision and the verified recovery snapshot.\n\nv11.19.3 acquired those two read fences separately. Its snapshot was coherent,\nbut a concurrent Commit could make the preceding compatibility verdict stale.\nPersonal single-node installs still upgrade normally in the app: v11.19.3 and\nv11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create\nan unsupported app-v28 transition, and the updater performs the recovery\nsnapshot, coordinated stop, final stopped-state snapshot, install, rollback,\nand restart automatically. No CLI or manual preflight is required. The\nstopped-node procedure in [`docs/UPGRADING.md`](docs/UPGRADING.md) is only for\nquorum or externally managed nodes where an operator can mutate governance\nduring the v11.19.3 check-to-fence window.\n\nThis patch changes no consensus rule, AppHash input, transaction type, key\nencoding, fork target, or application version. Existing app-v27 chains replay\nbyte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.4`. SDK 11.19.4.\n\n## What's New in v11.19.3\n\n**Normal upgrades now preserve compatible governance state automatically.**\nThe desktop updater reads the canonical pending plan and active proposal under\none runtime-consistent view before changing the executable. A supported\nin-flight upgrade is included in the existing verified recovery snapshot and\ncontinues after restart; it is not a reason to interrupt the user or block the\nupdate. No terminal command, preflight ceremony, or governance expertise is\nrequired.\n\nMalformed canonical state, an undecodable upgrade ballot, or a target newer\nthan this binary supports still fails closed before executable mutation. The\ntechnical `upgrade status` and stopped-node `upgrade preflight` commands remain\navailable for headless and quorum operators. **Superseded safety notice:** the\nv11.19.3 live updater did not hold one uninterrupted fence across that check and\nsnapshot capture. That does not impose a CLI step on a personal node; only\nquorum or externally managed governance needs the coordinated stopped-node\nprocedure when leaving v11.19.3.\n\nThis patch changes no consensus rule, AppHash input, transaction type, key\nencoding, fork target, or application version. Existing app-v27 chains replay\nbyte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.3`. SDK 11.19.3.\n\n## What's New in v11.19.2\n\n**Binary replacement now has consensus-authoritative upgrade-governance\nproof.** The read-only `/upgrade/governance-status` ABCI query reports the\ncurrent application version, the exact pending `upgrade:plan` record, and the\ncanonical `state:gov:active` proposal. Upgrade ballots include their decoded\ntarget application version. Storage, pointer/proposal identity, bounds,\ncanonical-name, status, height, and payload-decode failures return ABCI code 1\ninstead of being misreported as an empty plan or ballot.\n\n`sage-gui upgrade status` now consumes that fail-closed query rather than\ninferring safety from `/abci_info` plus the off-chain dashboard projection. The\nstopped-node `sage-gui upgrade preflight` command uses the same canonical\ninspector before the new server starts. v11.19.3 integrates that compatibility\ndecision into the normal updater and lets supported in-flight operations\ncontinue automatically.\n\nThis patch changes no consensus rule, AppHash input, transaction type, key\nencoding, fork target, or application version. Existing app-v27 chains replay\nbyte-identically.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.2`. SDK 11.19.2.\n\n## What's New in v11.19.1\n\n**Stranded message claims remain recoverable beyond the retained-history\nwindow.** `sage_inbox` now embeds the first passive, payload-free page of\nunfinished claims held by another runtime sharing the same exact agent identity.\nAgents can continue through every older page with\n`sage_message_history(folder=\"claimed_elsewhere\")`, then deliberately transfer\nan exact claim through the existing compare-and-swap `sage_message_handoff`\npath after deciding that its former claimant is dead or stale.\n\nThe recovery projection exposes only the message ID, claimant-session fence,\ntimestamps, and local/federated classification needed for safe handoff. It does\nnot expose sender identity, intent, payload, result, provider, or chain IDs.\nExpired TTL-bounded claims are also excluded consistently from both the exact\ndiagnostic count and its recovery pages before the periodic expiry sweep runs.\n\nProvider-addressed compatibility messages now bind atomically to the exact\nclaiming agent and MCP session, resurface on later polls, support CAS handoff,\nand complete idempotently through `sage_message_reply`. A failed reply explicitly\ndoes not authorize creating a substitute `sage_message_send`; agents must recover\nthe original claim or report the failure. Existing claimed provider rows receive\nan off-chain SQLite `legacy` session fence during startup migration.\n\nThis patch introduces no consensus change or application-version increase. The\nsupported consensus ceiling remains app-v27.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.1`. SDK 11.19.1.\n\n## What's New in v11.19.0\n\n**Record authors regain lifecycle authority in reserved shared namespaces.**\nAfter app-v27 activates, the immutable author of a record in `general`, `self`,\n`meta`, or `sage-*` may challenge that record and may reinstate its open\nchallenge without separately holding a level-3 Modify grant. The exception is\nrecord-scoped and does not apply to governance-promoted shared domains. Pending\nor inactive enrollment, read-only/profile restrictions, shared-write denies,\nand classification/clearance failures still deny the action. App-v21 weighted\nchallenge rounds include the eligible record author in their frozen electorate.\n\n**Omitted task status now has one canonical meaning.** After app-v27, a signed\nnew-task request that omits `task_status` is canonicalized to `planned` by both\nREST transaction construction and consensus proof verification. Pre-app-v27\nchains retain the historical requirement to send `task_status: \"planned\"`\nexplicitly, preserving replay and AppHash compatibility.\n\nApp-v27 is a governed consensus upgrade from app-v26 with no state migration.\nIts rules begin at H+1 after activation; older blocks replay under their original\napplication version.\n\nContainer: `ghcr.io/l33tdawg/sage:11.19.0`. SDK 11.19.0.\n\n## What's New in v11.18.28\n\n**Reserved shared domains are readable again without becoming ownable.** Active\nlocal principals can read the compile-time shared namespaces `general`, `self`,\n`meta`, and `sage-*`, while each record's classification still applies. This\nrestores the shared-domain behavior expected by existing agents without opening\nprivate or restricted records.\n\nAccess-grant transactions now reject attempts to register either those reserved\nnamespaces or governance-promoted shared domains as owned domains. REST reports\nthat conflict as a forbidden request, and the API, SDK, and RBAC references now\nstate the same contract.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.28 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.28`. SDK 11.18.28.\n\n## What's New in v11.18.27\n\n**Empty semantic recall now distinguishes genuine absence from an incomplete\nvector-space view.** For an empty, domain-scoped semantic query, `index_status`\nreports `complete`, `incomplete`, or fail-closed `unavailable` only when the\ncaller and exact query universe support that conclusion. The same signal is\nrelayed through `sage_recall` and `sage_turn`, so write-on-absence agents can\navoid manufacturing duplicates when committed memories are temporarily\nunreachable in the active embedding space.\n\nThe proof is caller-safe and race-fenced across canonical projection, SQL,\nembedding-space, and vault generations. Narrowed or federated queries and\nunhealthy projections never receive a false completeness claim, while bounded\nindexed probes keep the empty-result path operationally safe.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.27 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.27`. SDK 11.18.27.\n\n## What's New in v11.18.26\n\n**The supported Go dependency baseline is refreshed.** This release carries\nthe validated `testify` 1.12.0, `x/crypto` 0.55.0, and `x/tools` 0.49.0 module\nupdates already exercised by the full repository gate.\n\n**Code scanning and native-shell CI actions are refreshed to their pinned\ncurrent revisions.** CodeQL runs with the updated action bundle and the native\nshell cache action is updated, without changing SAGE runtime behavior.\n\n**HTTP MCP tokens now bind to existing approved managed identities.** On\napp-v23 nodes, token creation no longer generates an unapprovable pending\nprincipal: Root/Admin selects an active ordinary agent already managed by the\nnode, and issuance fails closed if its exact key is unavailable. The CLI also\nhandles `mcp-token create --help` without minting a credential and rejects\nunknown creation flags.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.26 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.26`. SDK 11.18.26.\n\n## What's New in v11.18.24\n\n**Federated inbox work now has recoverable, session-fenced ownership.** SAGE\nbinds an inbound federated claim to the receiving MCP session before exposing\nits payload. Retained older claims receive an explicit `legacy` CAS fence for\ndeliberate handoff; live work is never stolen by a timeout. Reply completion,\nthe claimant check, encrypted result fingerprint, and durable return event now\ncommit atomically, so a lost-response retry returns the original event while a\ndifferent second reply conflicts.\n\n**MCP boot guidance no longer rides inside ordinary tool results.** Lifecycle\nstanding stays in `initialize.instructions`, including for a client that\ninitializes after its first tool call. The former imperative block that asked an\nagent to invoke tools and edit a memory file has been removed, keeping the inbox\ntrust boundary internally consistent.\n\n**Embedding-space and retention diagnostics are more precise.** The readiness\nguard labels only a qualified-versus-bare spelling of the same provider/model\nleaf/dimension as a likely alias, without collapsing two organizations that\npublish the same basename. Durable-until-handled presentation is limited to\nactionable pending/claimed work, while mixed-version retention-only responses\nremain compatible.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.24 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.24`. SDK 11.18.24.\n\n## What's New in v11.18.23\n\n**Turn-time recall now carries the same trust and lifecycle evidence as explicit\nrecall.** `sage_turn` includes each recalled memory's `corroboration_count` and\n`status`, so the every-turn path no longer hides corroboration weight or whether\na recalled row is committed or currently challenged.\n\n**Embedding-space drift is visible before it silently empties semantic recall.**\nAt boot, SAGE compares the active embedder with the non-deprecated vector spaces\nalready in the local store. A mismatch produces a loud warning and a structured\n`embedding_space` block in `/ready`; the node remains available by default while\nstrict readiness returns 503, allowing an intentional re-embed migration to\nfinish instead of turning a quality warning into an outage.\n\n**Managed reranker setup now diagnoses incompatible prebuilt engines.** After a\nverified install, SAGE preflights `llama-server`. Proven GLIBC, GLIBCXX, or CXXABI\nloader failures preserve the loader's real error and point operators to the\nbring-your-own reranker path instead of reporting a successful unusable install.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.23 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.23`. SDK 11.18.23.\n\n## What's New in v11.18.22\n\n**A missing optional ForceGraph API can no longer strand CEREBRUM after the\nverified brain has rendered.** The renderer now publishes the core graph and\ntruthful counts before optional anatomical, control, and interaction setup. The\nbundled runtime's absent `clickAfterDrag` helper is feature-gated, so the brain\nhull, controls, and auto-rotation continue instead of falling into the cold\nunavailable path with real nodes already on screen.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.22 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.22`. SDK 11.18.22.\n\n## What's New in v11.18.21\n\n**A domain-summary refresh can no longer cover a verified MRI graph.** The MRI\nrenderer is now the sole authority for the central unavailable overlay. Domain\ninventory failures stay localized to their own retrying panel, while genuine\ncold graph failures and unsafe mode switches remain fail-closed.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.21 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.21`. SDK 11.18.21.\n\n## What's New in v11.18.20\n\n**A transient MRI refresh no longer hides a graph CEREBRUM has already\nverified.** Memory and Connectome snapshots now retain their explicit source\nmode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible\nonly when it belongs to that same mode, while retrying in the background. Cold\nfailures and failed mode switches still fail closed, so Connectome bytes can\nnever masquerade as a verified memory projection.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.20 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.20`. SDK 11.18.20.\n\n## What's New in v11.18.19\n\n**Codex project hooks stay inside their project.** The v11.18.18 byte-exact\nself-healer could mistake Codex's user-global `~/.codex` configuration directory\nfor a project and generate a global `hooks.json`. That made an unrelated Codex\ntask receive SAGE inbox Stop nudges for the shared agent identity. The healer now\nrefuses the user-home/global scope; project-local hooks continue to self-repair.\n\n**Connectome clicks now have one hit-tested owner.** The redundant DOM click\nfallback that raced ForceGraph's deferred node click is gone. Small pointer\nwobble is handled by one explicit tolerance, background dismissal uses the\ngraph's raycast result, and clicking a second neuron no longer closes the\ninspector and starts a competing zoom-out first. Raw domain-access metadata is\nsummarized behind a bounded disclosure below traffic, relationships, and memory\ndetails; bloomed memory nodes now expose hover and accessible click feedback.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.19 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.19`. SDK 11.18.19.\n\n## What's New in v11.18.18\n\n**Codex upgrades now repair stale SAGE lifecycle hooks automatically.** On\nevery MCP startup, the project self-healer compares all five installer-owned\nCodex hook scripts with their fully rendered current templates. A mixed\ngeneration can no longer pass merely because the files exist or another hook\nmentions the current binary. Upgrading therefore replaces legacy no-op Stop\nhooks and malformed prompt hooks without requiring a second manual\n`sage-gui codex install` run.\n\n**The CEREBRUM Connectome now leads with the graph itself.** Neurons have a\nlarger practical click target; clicking one opens its persistent identity,\nvisible incoming/outgoing traffic, strongest peer, directed connection list,\nand visible memory lobe. The compact fallback selector now shows only agents\nwith visible peer relationships, ordered by retained traffic, instead of\nturning a large dormant/test roster into the primary navigation surface.\nIsolated authorized neurons remain visible and clickable in the brain and join\nthe selector while selected.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.18 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.18`. SDK 11.18.18.\n\n## What's New in v11.18.17\n\n**Routine MCP restarts no longer make the same stdio agent disown its own\nunfinished messages.** The primary stdio runtime now persists one opaque\nclaimant identity per exact signed agent, provider, and project under\n`SAGE_HOME`, and holds an OS advisory lock as the liveness fence. A later\nruntime reuses that identity only after the earlier process is no longer live;\na genuinely concurrent runtime receives an independent identity and retains\nthe existing one-handler and compare-and-swap handoff boundary. In-place\ninstalled-binary handoff also carries the current claimant identity while the\nold process keeps the lock alive.\n\nThe fix is deliberately prospective and does not bulk-transfer historical\nclaims created by pre-v11.18.17 random process identities. Those rows remain\nvisible through `claimed_elsewhere_count` and passive history and can still be\ntransferred one at a time with the existing CAS-fenced handoff after the old\nclaimant is known dead. HTTP MCP conversations remain transport-scoped. This\npatch introduces no new consensus application version or state migration. The\nceiling remains app-v26; **v11.18.17 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.17`. SDK 11.18.17.\n\n## What's New in v11.18.16\n\n**Claimed agent work no longer disappears from the inbox that claimed it.**\n`sage_inbox` now returns a separate bounded `own_claimed_unfinished` projection\nfor messages already owned by the exact current agent session. The projection\nis passive: it never claims, refreshes, transfers, or duplicates work, and it\ndoes not change the established `items` or `count` meaning of newly available\nwork. Exact agent/session filtering, completion and expiry handling, bounded\nresults with an exact total, reply-after-repoll, and nonmutation are pinned by\nstore, REST, and MCP regression coverage.\n\nThe payload-free hook status path also checks the durable wake snapshot, so\nclaimed-but-unfinished work cannot be reported as a clean inbox merely because\nno unclaimed row remains. Older or temporarily incapable nodes degrade to an\nexplicit `unavailable` state instead of either a false zero or a failed primary\ninbox call. This patch does not automatically transfer claims from another\nsession; passive history plus explicit compare-and-swap handoff remain the\nrecovery boundary. It introduces no new consensus application version or state\nmigration. The ceiling remains app-v26; **v11.18.16 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.16`. SDK 11.18.16.\n\n## What's New in v11.18.15\n\n**Every unfinished exact-recipient local canonical message now has a durable\nwake generation, including upgrade-era claimed-only work and sends through the\ndeprecated pipe route.** Startup backfill covers both pending and claimed rows, so a recipient\nwhose only live work was already claimed cannot reopen as the silent\n`{seq:0,pending:true}` state. Keyed exact-local pipe sends use the canonical\nidempotent admission path; unkeyed sends insert the row and advance the same\nrecipient sequence atomically. Publication happens only after commit, exact\nreplays do not republish, and an incapable backend fails before insertion rather\nthan creating durable work that wake consumers cannot observe as new.\n\nThe experimental Claude notification adapter is explicitly opt-in again. The\nshipped Claude Code host registers the custom notification handler, but\nend-to-end delivery from a plain `.mcp.json` server through its plugin-scoped\ngate remains unverified. An idle adapter would also acquire the one exact-agent\nwake lease and exclude a useful long-running consumer.\n`SAGE_CLAUDE_CHANNEL=true` enables it for an operator who has confirmed that\ndelivery path.\n\nPending-memory presentation is deterministic even when creation timestamps tie:\nSQLite and PostgreSQL both use `memory_id` as the final ordering key. The\ndocumentation citation guard now parses newline-separated and hyphenated paths,\npins every concrete declaration/lead/interior anchor, repairs only explicitly\naccepted declaration anchors, refuses semantic locations it cannot reconstruct,\nand inventories the remaining legacy skipped and bare references. This patch\nintroduces no new consensus application version or state migration. The ceiling\nremains app-v26; **v11.18.15 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.15`. SDK 11.18.15.\n\n## What's New in v11.18.14\n\n**Durable agent messages now stay visible until the work is actually\nfinished.** Claiming a message no longer makes the payload-free wake surface go\nquiet: both pending and claimed rows remain unfinished, a reconnect at the\ncurrent cursor receives an immediate wake, and `sage_inbox` reports an exact\npayload-free claimed-elsewhere state instead of a bounded-scan false zero.\nClaude Code project sessions arm the signed wake channel by default, while the\noptional Stop hook reads a lease-free monotonic snapshot so new or stranded\nwork can nudge a session once without stealing the live SSE consumer lease.\n\nThe same recovery path is honest at its edges. A claimant-session fence\nrejection remains a typed conflict instead of masquerading as a missing\nmessage, and history plus explicit compare-and-swap handoff remain the only\nway to recover another session's claim. Canonical retention migration now\nrescues only the exact historical 24-hour stamp, preserving a sender's chosen\nbounded TTL across every store reopen, including RFC3339 nanosecond timestamps.\n\n**CEREBRUM's Connectome now identifies the agents it renders.** Hover details\nare positioned and escaped reliably, while click, tap, and keyboard selection\nopen one persistent inspector with exact agent identity, visible retained\ntraffic, peers, activity, and an independently loading visible-memory lobe.\nSelection survives authorized live refreshes, error and empty states stay\ntruthful, mobile uses a bounded sheet, and reduced-motion and established\nConnectome guidance remain intact.\n\nAgent-as-lobe corroborator reads now use one deterministically ordered bounded\nbatch instead of an N+1 query pattern, with matching SQLite and PostgreSQL\nordering. The MCP contract also states the server-enforced 31-day\n`sage_timeline` range rather than advertising requests the server rejects.\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.14 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.14`. SDK 11.18.14.\n\n## What's New in v11.18.13\n\n**Hubanov's distributed-engram contribution now connects memories to the\nneurons that corroborated them.** CEREBRUM keeps agent and memory identities in\nseparate graph namespaces, rejects stale bloom generations, and removes every\ntransient bridge on focus or graph replacement. The server uses a deterministic,\nindexed 96-row evidence prefix and exposes at most 12 authorized bridges without\nturning historical corroboration into a claim of current possession.\n\n**Claude's production wake source can now arm the payload-free message bus.**\nWhen explicitly enabled with `SAGE_CLAUDE_CHANNEL`, the MCP runtime consumes the\nexisting signed SSE wake route with a random process lease and resumable cursor.\nDelivery applies backpressure instead of dropping the newest wake, and shutdown\nreleases saturated readers without leaking goroutines or claiming message\ncontent.\n\n**The Connectome no longer floats an instructional card over the brain.** Its\nguidance lives in the existing reading panel, the mode toggle keeps one stable\nname and visible pressed state in both themes, keyboard focus remains clear,\nmobile Reset behavior stays intentional, and view changes are announced to\nassistive technology.\n\nThis patch also closes a claimant-session compatibility bypass: a current typed\n404 is authoritative, the deprecated pipe-result alias carries the active MCP\nsession, and only a genuine old-node route miss may fall back. It introduces no\nnew consensus application version or state migration. The ceiling remains\napp-v26; **v11.18.13 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.13`. SDK 11.18.13.\n\n## What's New in v11.18.12\n\n**CEREBRUM can now open an agent as a memory lobe.** Selecting a connectome\nneuron lazily blooms that agent's highest-confidence visible memories as\nengrams, while retaining the operator-only route and app-v23 per-record\nprojection checks. The indexed, bounded query avoids whole-brain scans; stale,\nfailed, and disposed frontend requests cannot leave another agent's lobe on\nscreen.\n\n**Dashboard live activity is now guarded as one exact 20-event registry.** The\nseven previously unwired operator events now reach the existing dashboard SSE\nstream, while message wake, MCP, and wizard protocols stay route-local. A\nfail-closed typed control-flow audit and executable browser contract reject\ndead, aliased, escaped, build-tagged, or decoy event sinks.\n\n**Signed task creation and message attribution now agree end to end.** Every\nofficial task constructor explicitly signs the required initial `planned`\nstatus, and REST fails fast instead of mutating an omitted signed field into a\ntransaction that app-v23 through app-v26 must reject. Authorized message and\npipe responses retain exact immutable agent IDs alongside mutable presentation\nlabels, use one bounded batch metadata query on healthy production stores with\na bounded exact-ID fallback, suppress foreign-chain label collisions, and keep\ncount-only responses identity-free.\n\nThis patch also repairs release-facing documentation drift, pins the current\n33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the\nreferences it can verify. It introduces no new consensus application version\nor state migration. The ceiling remains app-v26; **v11.18.12 introduces no\napp-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.12`. SDK 11.18.12.\n\n## What's New in v11.18.11\n\n**The CEREBRUM connectome now fires live without widening its operator-only\nboundary.** Successful local message sends emit a contentless invalidation tick;\nthe browser then refetches the existing caller-filtered snapshot and pulses only\nnewly observed synapses. Monotonic generations preserve later ticks across\nin-flight requests, ordinary reloads, failures, and retries, while initial loads\nand unrelated refreshes never create false activity.\n\n**Dashboard retrieval activity no longer duplicates authorized memory plaintext\ninto the global operator stream.** Recall, search, and hybrid events now expose\nonly their event type and result count. The obsolete expandable plaintext panel\nis gone, and serialized-frame regressions pin the contentless contract and live,\nnon-replayed delivery.\n\n**Claude bookend sessions can discover waiting SAGE messages without claiming or\nrevealing them.** A signed, payload-free inbox-status hook reports only the\ncurrent identity and unread count, makes failures visible, preserves unrelated\nuser hooks during self-heal, and exposes the read-only message tools needed to\nperform the explicit inbox fetch.\n\nThis patch also keys local connectome locality by chain identity, removes a stale\napp-v7 validator warning after app-v14, dims the connectome skull for legibility,\nrequires patched Go 1.25.13 throughout current builders and CI, and publishes\nchecksum sidecars for Windows executables. It introduces no new consensus\napplication version or state migration. The ceiling remains app-v26;\n**v11.18.11 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.11`. SDK 11.18.11.\n\n## What's New in v11.18.10\n\n**Multiple MCP runtimes sharing one agent identity can no longer silently lose\ntrack of claimed messages.** Every MCP conversation now has an opaque claimant\nsession ID. Atomic inbox claims persist that session in passive history, an\nexplicit compare-and-swap handoff transfers work between runtimes, and a stale\nformer owner is rejected if it tries to reply after ownership moved. Receive\ntokens remain replay-safe after a lost response, while legacy direct REST\nclients retain their existing agent-level compatibility path.\n\n**CEREBRUM can render the agent message bus as a live connectome inside the 3D\nbrain.** Registered agents become domain-coloured neurons, directed channels\nbecome traffic-weighted synapses, and hub agents settle toward the core. The\nview consumes the existing RBAC-filtered synapse projection, drops ghost edges,\nand fences asynchronous mode switches so a slow memory response can never be\ndisplayed as connectome data.\n\n**Upgrade-watchdog submissions can no longer hold a signing key's nonce lease\nfor the process lifetime when CometBFT wedges.** One bounded context now covers\nboth lease acquisition and the broadcast. A deadline after submission remains\na typed indeterminate outcome, so the exact signer and bytes stay fenced until\ntheir fate is reconciled; elapsed time never releases the key fail-open.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.10 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.10`. SDK 11.18.10.\n\n## What's New in v11.18.9\n\n**Ambiguous CometBFT commit and sync outcomes are now typed at the shared\nbroadcaster boundary.** Transport, status, RPC, decode, shape, hash-binding, and\nmissing-height failures return `ErrSubmitIndeterminate` for valid signing keys,\nwhile the existing live-registration path remains an independent fence\nbackstop. Pre-send request-construction failures remain definitive and do not\nfence a key over bytes that never reached a transport.\n\n**Federation sync now fails closed if its commit broadcaster ever violates its\ncontract by returning neither a result nor an error.** The exact signer and\nencoded transaction remain fenced until reconciliation proves their fate,\ninstead of releasing the key for a potentially in-flight transaction. A new\ncross-package decoder contract also pins the HTTP prologue shared by\n`internal/tx` and the CEREBRUM web path while recording their deliberate verdict\nand envelope-tolerance differences.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.9 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.9`. SDK 11.18.9.\n\n## What's New in v11.18.8\n\n**CometBFT transaction submissions no longer permit Go's HTTP transport to\ntransparently redeliver a fenced request after a reused connection fails while\nreading the response.** Commit, sync, byte-identical nonce-fence reconciliation,\nand CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam.\nEach submission call writes its transaction on one connection and returns an\nindeterminate result instead of silently delivering the same signed bytes to a\nsecond responder. Restart failure reporting also preserves the signer-fence\nveto ahead of a generic drain timeout.\n\n**MCP reply polling now fails safe when a caller presents an unsafe forward\nwatermark.** If `reply_since` is later than the authoritative retained-reply\nhead, or no head exists to validate it, `sage_inbox` returns the newest passive\nreply page for deduplication instead of filtering a formal reply into a false\nempty result. Complete recovered pages become a new safe baseline; truncated\npages require composite-cursor catch-up, and failed page reads never claim\nrecovery. A successful outbound `sage_message_send` also performs one bounded,\nsender-exact passive inbox snapshot so an inbound message that arrived after an\nearlier empty poll is surfaced during continued coordination.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.8 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.8`. SDK 11.18.8.\n\n## What's New in v11.18.7\n\n**Large signed transactions now use a bounded CometBFT transport instead of\noverflowing request headers.** Existing smaller broadcasts keep the established\nGET wire shape, while large commit, sync, and byte-identical nonce-fence\nreconciliation requests use JSON-RPC POST with base64 transaction bytes. Client\ntransaction and JSON-RPC body limits are independently range-checked, capped at\n8,000,000 bytes, and refuse an oversized request before send. Operators raising\nthem must configure matching CometBFT limits. Independently, every validator\nenforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic\nfinalization, sufficient for the measured 1,304-entry SkillRegistry transaction.\nMemory content remains bounded at 512 KiB, while the canonical signed\n`AgentRequest` proof has its own 600,000-byte consensus bound, admitting the\nmeasured 573,723-byte proof without widening the content or aggregate limits.\nResponse handling accepts strict quoted or numeric `int64` heights, rejects\nfractional, exponent, null, malformed, and out-of-range heights, and refuses\nunsupported content types.\n\n**Federation route refresh no longer risks recursively acquiring the\nsync-policy read lease from a peer-request caller.** Opportunistic refresh\nadmission is policy-free and bounded to one pending refresh per peer; the\nagreement and binding lookup runs asynchronously after the request caller can\nrelease its lease. Failed-request and successful-Direct triggers remain\ncovered, while the route-exchange endpoint does not self-trigger refresh.\n\n**P2P-only peers can recover when their stored route snapshot is missing or\nbelongs to an older trust generation.** Only the authenticated\n`/fed/v1/p2p/routes` bootstrap exchange may use stale or current route addresses\nas connection hints; the current agreement's pinned mTLS identity remains\nauthoritative. Protected requests reject missing or cross-generation snapshots\nwith `trust_generation_mismatch`. A matching-generation empty target set remains\nexplicitly pinned and cannot fall back to current configuration.\n\n**Federation diagnostics now give security evidence precedence over route\navailability evidence.** Mixed route-availability plus certificate, SPKI, pin,\nidentity-mismatch, or security-block evidence is classified as\n`security_blocked`; revocation, expired or unknown agreement, trust-failure, or\nauthentication evidence is classified as `trust_failure`. Both verdict classes\noutrank route availability.\n\nThis patch introduces no new consensus application version or state migration.\nThe ceiling remains app-v26; **v11.18.7 introduces no app-v27**.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.7`. SDK 11.18.7.\n\n## What's New in v11.18.6\n\n**Updater snapshots now prove both supported CometBFT layouts before they are\npublished or reused.** Application Badger and persisted consensus state must\nmatch at height `H` and agree on the application hash. A blockstore committed\nthrough `H` is accepted only after its `H` block ID and seen commit match that\nstate. If the blockstore is durably one block ahead at `H+1`, SAGE additionally\nverifies the complete block and part identity, direct-parent and state-derived\nheader fields, last and seen commits, validator signatures, and CometBFT's\nreplay-time block validation. Regression coverage restores the candidate and\nruns the real CometBFT handshaker, proving exactly one replayed block and safe\nrestart reuse. Malformed or more-than-one-ahead provenance is rejected, and an\ninvalid prior publication is quarantined before a valid replacement can be\npublished. Cancellation always blocks executable updater handoff, although a\nsafe snapshot may already have been atomically published. Non-empty `H+1`\nevidence is retryable until application and state catch up.\n\n**Federation Retry now performs one bounded, exact-generation recovery\nworkflow.** Concurrent operator clicks share the same route refresh and\nauthenticated status probe. Direct and relay targets are frozen to the active\nJOIN generation, HTTP `401`/`403` and certificate/identity failures stop before\nre-probing, and a revoke or re-pair during the response invalidates the result.\nTyped dashboard diagnostics distinguish missing or expired route bundles,\nstale Direct routes, unavailable relays, trust-generation changes, and legacy\nconnections that must be paired again. Ordinary polling and mutating requests\ndo not enter this retry path.\n\n**Memory-reassignment audit failures no longer place request-controlled agent\nIDs in logs.** The source and target are represented by fixed 96-bit truncated\nSHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable\nincident correlation without allowing CR/LF or other control characters to\nforge log records.\n\nThis patch does not change consensus state or application activation. The\nceiling remains app-v26; **v11.18.6 introduces no app-v27**. The signer fence\nalso remains process-local: unresolved submissions still require proof of fate,\nand crash/restart or a separate signing process is not claimed safe until\ndurable cross-process pre-broadcast intent exists.\n\nContainer: `ghcr.io/l33tdawg/sage:11.18.6`. SDK 11.18.6.\n\n## What's New in v11.18.5\n\n**Long-lived stdio MCP sessions now follow an installed SAGE upgrade without\nexecuting a request under stale tool",
"bytes": 60000,
"sha": "0aed1bf17dd03d098cbf5667f45d73203514ff4a620388423386cc2f86ecd765",
"repo_slug": "l33tdawg/sage",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_l33tdawg_sage_1e6b3406/readme"
}