io.github.l33tdawg/sage

Persistent, consensus-validated institutional memory for AI agents. Runs locally.

Open source Open in the app JSON README (API)

About

Persistent, consensus-validated institutional memory for AI agents. Runs locally.

Details

Kind: MCP servers
Topic: AI, RAG & memory
Publisher: l33tdawg
Origin: official
Category: ferramentas
Transport: local
Version: 11.19.18
Stars: 245
Forks: 27
Last push: 2026-09-04T16:29:20Z
Repository state: ativo
Language: Go
License: Apache-2.0
Added: 2026-08-29 04:00:22
Updated: 2026-09-13 12:00:58
Origin id: io.github.l33tdawg/sage

README

# (S)AGE — Sovereign Agent Governed Experience

**Persistent, consensus-validated memory infrastructure for AI agents.**

SAGE gives AI agents institutional memory that persists across conversations, goes through BFT consensus validation, carries confidence scores, and decays naturally over time. Not a flat file. Not a vector DB bolted onto a chat app. Infrastructure — built on the same consensus primitives as distributed ledgers.

The architecture is described in [Paper 1: Agent Memory Infrastructure](papers/Paper1%20-%20Agent%20Memory%20Infrastructure%20-%20Byzantine-Resilient%20Institutional%20Memory%20for%20Multi-Agent%20Systems.pdf).

> **Just want to install it?** [Download here](https://l33tdawg.github.io/sage/) — double-click, done. Works with any AI.

[Quick Start](#quick-start) · [Architecture](#architecture) ·
[Capabilities](#current-capabilities) · [Dashboard](#cerebrum-dashboard) ·
[Release history](#release-history) · [Documentation](#documentation)

---

## Quick Start

**Desktop:** [Download the latest release](https://github.com/l33tdawg/sage/releases/latest),
open SAGE, then use CEREBRUM to connect your AI. For a full walkthrough, see
[Getting Started](docs/GETTING_STARTED.md).

**From source (Go 1.25.13+):**

```bash
git clone https://github.com/l33tdawg/sage.git && cd sage
go build -o sage-gui ./cmd/sage-gui/
./sage-gui setup # Pick your AI, get MCP config
./sage-gui serve # SAGE + Dashboard on :8080
```

Or grab a binary: [macOS DMG](https://github.com/l33tdawg/sage/releases/latest) (signed & notarized) | [Windows EXE](https://github.com/l33tdawg/sage/releases/latest) | [Linux tar.gz](https://github.com/l33tdawg/sage/releases/latest)

<details>
<summary>Docker and containerized MCP setup</summary>

### Docker

```bash
docker pull ghcr.io/l33tdawg/sage:latest
docker run -d --name sage \
-p 8080:8080 \
-v ~/.sage:/root/.sage \
ghcr.io/l33tdawg/sage:latest
```

Pin a specific version with `ghcr.io/l33tdawg/sage:11.19.15`.

The SAGE server stays in that container. To give a local MCP client a stdio
bridge, start a second process **inside the same running container**:

```bash
docker exec -i \
-e SAGE_PROVIDER=claude-code \
-e SAGE_PROJECT=my-project \
-e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
sage /usr/local/bin/sage-gui mcp
```

For the shipped Compose stack, use the service name rather than a generated
container name:

```bash
docker compose -f docker-compose.sage-gui.yml exec -T \
-e SAGE_PROVIDER=claude-code \
-e SAGE_PROJECT=my-project \
-e SAGE_IDENTITY_PATH=/root/.sage/agents/claude-code-my-project/agent.key \
sage /usr/local/bin/sage-gui mcp
```

If an MCP client launches this through a wrapper, point its stdio configuration
at the wrapper's absolute path. Pass `SAGE_PROVIDER`, `SAGE_PROJECT`, and
`SAGE_IDENTITY_PATH` through `docker exec -e`/`docker compose exec -e`; setting
them only on the host-side Docker command does not place them in the container.
Keep the whole SAGE data root mounted at `/root/.sage`, including agent keys and
the ledger. Do not start a separate `docker run ... mcp` container: its
`localhost:8080` is isolated from the running SAGE server.

HTTP MCP is also available at `/v1/mcp/sse` and `/v1/mcp/streamable`, but both
require a bearer token or OAuth. Bare `http://localhost:8080` is the REST base,
not an unauthenticated MCP endpoint.

</details>

<details>
<summary>Upgrading an existing node</summary>

### Upgrading from an older version?

**Upgrading an existing node — including the v10.x → v11 jump — is
[docs/UPGRADING.md](docs/UPGRADING.md).** In the desktop app, accept the update:
SAGE verifies canonical upgrade compatibility, captures a full recovery
snapshot, installs, and restarts automatically. Headless and quorum operators
have separate technical procedures in the guide.
Your chain advances in place; a personal node climbs the consensus fork ladder by
itself. Read the guide before a multi-admin chain crosses app-v23 — that
activation re-derives administrator authority.

If you installed SAGE before v5.0 and your AI isn't doing turn-by-turn memory updates, re-run the installer in your project directory:

```bash
cd /path/to/your/project
sage-gui mcp install
```

This installs Claude Code hooks that prompt the memory lifecycle (boot, turn, reflect) — even if your `.mcp.json` is already configured. Restart your Claude Code session after running this.

</details>

---

## Architecture

```mermaid
flowchart TB
A["AI agents · MCP / SDK / REST"] --> P["SAGE node · authenticated admission + live policy"]
H["CEREBRUM · local human control"] --> P
P --> M["Memory + local policy transactions CometBFT / ABCI"]
P --> W["Node-local coordination inbox / claims / replies"]
M --> B["BadgerDB authoritative chain state"]
B --> Q["Commit-time SQL projection content + vectors for authorized recall"]
P -. "explicit peer trust and sharing" .-> F["Separate SAGE chain bounded Read / receiver-controlled Copy"]
classDef entry fill:#eef2ff,stroke:#6366f1,color:#1e293b
classDef memory fill:#ecfdf5,stroke:#059669,color:#064e3b
classDef work fill:#fff7ed,stroke:#d97706,color:#7c2d12
class A,H,P entry
class M,B,Q memory
class W,F work
```

**Agents are not validators.** Personal mode runs one real CometBFT validator
with a per-node memory auto-voter; it has no Byzantine redundancy. Registering
more agents does not add consensus voters. A multi-validator deployment runs
one shared chain; federation connects separate chains under explicit policy.

**Storage has two roles.** BadgerDB is authoritative for consensus state.
SQLite (personal) or PostgreSQL + pgvector (cluster) projects memory content
and vectors at Commit. Node-local message coordination is separate from the
memory consensus path. Block inclusion is not the same as memory acceptance.

For the detailed trust boundaries, lifecycles, and deployment topology, see
[Architecture & Deployment](docs/ARCHITECTURE.md).

## Current Capabilities

| Capability | What it provides |
|------------|------------------|
| Governed memory | Persistent, attributed memories with consensus validation, semantic recall, confidence, and lifecycle controls |
| Durable tasks | Exact-agent assigned backlog; open tasks do not decay; idempotent creation and workflow status |
| Unified inbox | Local/federated requests, assignment notices, and a separate passive reply page |
| Runtime handoff | Explicit session-and-revision-fenced takeover of claimed work within the same signed agent identity |
| Access controls | Active enrollment, roles/profiles, ownership, Access Groups, compatible grants, and classification checks |
| Controlled federation | Explicit agent exports and bounded Read/Copy policy, without granting local membership or Write |
| Recovery and updates | In-place chain upgrades, recovery snapshots, and retained message claims across ordinary restarts |

### How agents collaborate

```mermaid
flowchart TB
T["Task assigned to exact agent"] --> N["One-way assignment notice"]
N --> I["Unified inbox"]
R["Request addressed to exact agent"] --> I
I -->|"task notice"| V["Verify current assignment in backlog then update the task"]
I -->|"inbound request"| C["Claimed by one MCP runtime"]
C -->|"normal completion"| O["Idempotent reply"]
C -. "intentional same-agent takeover" .-> H["Handoff: expected session + revision"]
H --> O
O --> S["Original sender reads reply_items or pages retained replies"]
classDef input fill:#eef2ff,stroke:#6366f1,color:#1e293b
classDef task fill:#ecfdf5,stroke:#059669,color:#064e3b
classDef message fill:#fff7ed,stroke:#d97706,color:#7c2d12
class I input
class T,N,V task
class R,C,H,O,S message
```

Assignment, claim, and reply are different states. A task notice is not a
request for a message result, and a reply is not a new assignment. Runtime
handoff does not reassign a task to another agent. Wake notifications are
payload-free hints, not delivery or claim evidence. Every agent request and
result remains untrusted data, not authority to expand the user's instructions.

See the [MCP task/inbox reference](docs/reference/mcp-tools.md) and
[message/reply lifecycle](docs/reference/concepts/message-reply-lifecycle.md)
for exact fields, recovery, and authorization rules.

---

## CEREBRUM Dashboard

![CEREBRUM MRI brain — memories mapped inside a 3D brain with focused related notes](docs/screen-brain.png)

`http://localhost:8080/ui/` — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.

The dashboard also includes governed agent enrollment, Access Groups, domain
permissions, separate CEREBRUM Root credential handover, import/export,
software updates, and encryption controls. Ordinary agent identity replacement
uses re-enrollment; historical memory authorship is preserved.

---

## What's New in v11.19.15

**Consensus-safe memory cleanup, without the 500-record cap.** CEREBRUM now
scans the full inventory, previews verified eligible counts, and processes
manual or automatic cleanup through existing consensus challenge transactions.
Open tasks and internal records are protected. The UI distinguishes queued work,
confirmed submissions, and observed outcomes instead of reporting premature success.

Automatic cleanup requires **fresh current-Root authorization after upgrading**;
old enabled toggles do not silently activate it. Preview does not enable cleanup.
Exact signed transactions are saved before submission for safe recovery. A
challenge may need further votes; audit history is retained. See the
[cleanup guide](docs/reference/concepts/memory-cleanup.md).

No consensus-rule or application-version change; app-v27 remains the ceiling.
Container: `ghcr.io/l33tdawg/sage:11.19.15`. SDK 11.19.15.

## What's New in v11.19.14

**Security dependency update:** gRPC-Go is upgraded to v1.83.1 to address
HTTP/2 DATA-frame fragmentation heap exhaustion (CVE-2026-84304, Dependabot
alert #45). The required genproto and OpenTelemetry dependencies are refreshed
alongside it. CodeQL workflow actions are pinned to the verified v4.37.9 commit.

This patch introduces no consensus-rule, AppHash-input, key-encoding, fork-target,
or application-version changes. App-v27 remains the supported ceiling.

Container: `ghcr.io/l33tdawg/sage:11.19.14`. SDK 11.19.14.

## What's New in v11.19.13

**The stdio MCP bridge no longer self-installs project hooks into the user’s
home directory.** When `sage-gui mcp` starts with `$HOME` as its working
directory, automatic project repair now returns without writing `.claude`
hooks or project-relative hook registrations into user-global configuration.

Explicit `sage-gui mcp install` and `sage-gui codex install` commands keep their
existing home-directory refusal. Normal project-directory self-healing also
remains unchanged, including when `CLAUDE_CONFIG_DIR` points elsewhere.

This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.13`. SDK 11.19.13.

## Release History

The latest release notes are above. Earlier entries below describe behavior at
their release dates; use the current reference for present-day contracts.

<details>
<summary>Earlier releases — preserved changelog</summary>

## What's New in v11.19.12

**Project-scoped MCP and Codex installs can no longer corrupt user-global host
configuration.** `sage-gui mcp install` and `sage-gui codex install` now refuse
to run when the working directory resolves to the user's home directory. Run
the command from the intended project instead; ordinary project installs are
unchanged.

The native-shell build also refreshes its fail-closed checksum for the official
September `linuxdeploy-plugin-appimage` rebuild. The replacement was produced
by the upstream project's successful scheduled workflow from its unchanged
source commit, and its downloaded SHA-256 matches GitHub's release-asset
digest. An unexpected future replacement will continue to stop the build.

This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.12`. SDK 11.19.12.

## What's New in v11.19.11

**CEREBRUM now supports operator-configured hostnames behind a local TLS
reverse proxy.** Set `SAGE_ALLOWED_CEREBRUM_HOSTS` to an exact comma-separated
hostname allowlist when Caddy, Traefik, or another loopback proxy preserves the
browser-facing `Host` instead of rewriting it to `localhost`. Ports are
normalized and wildcards are deliberately unsupported.

The trust boundary stays local: the connected peer and every forwarded IP hop
must still be loopback, unconfigured hostnames still fail closed, and browser
origin matching accepts `X-Forwarded-Proto` only when every field-line and
comma-joined token is a valid, case-insensitive `http` or `https` value and all
hops agree. Empty, malformed, or mixed scheme chains are rejected.

This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.11`. SDK 11.19.11.

## What's New in v11.19.10

**Returning agents can be reviewed normally again.** When app-v26 retirement
has handed an agent's former home domain to the stable Root principal,
CEREBRUM reapproval now binds the existing owner and uses the established
Root-to-agent recovery transfer for that exact recorded home. Fresh or
operator-entered domains never receive an implicit transfer.

Rejecting a pending registration now counts active memories—the same lifecycle
view shown by the recovery panel—instead of treating deprecated audit history
as work the operator can still remediate. Active records continue to block
ordinary rejection unless they are deprecated, transferred, or the explicit
attribution-preserving force path is chosen.

This patch changes no consensus rule, AppHash input, key encoding, fork target,
or application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.10`. SDK 11.19.10.

## What's New in v11.19.9

**Codex workspace identity resolution now fails closed at the filesystem
root.** A user-level Codex MCP process launched from `/` can no longer reuse the
retired `global-codex` signer or auto-register the synthetic name `codex//`.
SAGE rejects that broad, untrustworthy boundary before Git discovery,
project-config lookup, key loading, or key generation. Real project and linked
worktree roots continue to resolve to their stable workspace identities;
operators who intentionally need a non-workspace shared identity must pin it
explicitly with `SAGE_IDENTITY_PATH`.

This patch changes no transaction, AppHash input, key encoding, fork target, or
application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.9`. SDK 11.19.9.

## What's New in v11.19.8

**Access Groups now discover transferred historical domains, not only each
member's enrollment-time home domain.** CEREBRUM's bounded caller-domain
projection consults the consensus-maintained current-owner index for the caller
and active local group peers. A transferred `user-*` domain therefore appears
as a usable exact recall or write target even when its current owner never
authored a memory there.

Every discovered candidate is still re-authorized against current ownership,
group authority, profile restrictions, and hard denies before it is returned.
Per-record classification checks remain on the memory disclosure path. The
result remains bounded and explicitly reports truncation; it does
not expose a global domain roster, change ownership, copy grants, or weaken
shared-domain and foreign-write restrictions.

This patch changes no transaction, AppHash input, key encoding, fork target, or
application version. Existing app-v27 chains replay byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.8`. SDK 11.19.8.

## What's New in v11.19.5

**Claim recovery and host wake coordination now survive real multi-transport
runtimes.** Both exact-local compatibility claim paths—`GET /v1/pipe/inbox`
and explicit `PUT /v1/pipe/{pipe_id}/claim`—atomically bind the session and
create its receipt, so ownership cannot commit without recovery evidence. MCP
claimant identities are durable and transport-scoped across stdio,
Streamable HTTP, and SSE; `claimant_identity_mode` discloses whether the
identity is durable, a safe concurrent ephemeral fallback, inherited, or
unavailable.

Claim transfer remains deliberate. `sage_message_handoff` requires the exact
`claimant_session_id` and `claim_revision` returned by passive history; stale
or A→B→A delayed transfers fail the revisioned compare-and-swap fence. The
direct REST route preserves pre-v11.19.5 clients by treating an omitted
`from_revision` as 0 only, so it can move an untouched first-generation claim
but safely conflicts after any transfer. SAGE never steals a claim merely
because it is old.

The new signed, payload-free `GET /v1/inbox/activity-state` returns exactly
`{version,epoch,seq}` so host hooks can notice fresh task assignments and
replies. The opaque 32-character database-incarnation `epoch` survives process
restarts and backup restore, but changes for a fresh database so an old host
cursor cannot suppress new cues after reinitialization.
Those events remain nonblocking coordination: they do not change the exact
three-field `{version,seq,pending}` contract of `/v1/messages/wake` or
`/v1/messages/wake-state`, and they never make Stop treat a reply as unfinished
work. Hooks can surface activity on the next prompt, but cannot resurrect an
already-idle host task.

This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. The supported consensus ceiling
remains app-v27.

Container: `ghcr.io/l33tdawg/sage:11.19.5`. SDK 11.19.5.

## What's New in v11.19.4

**Updater governance compatibility and recovery state are now one atomic
proof.** The replacement binary reports its own maximum supported application
version. SAGE validates canonical pending-plan and active-ballot state against
that exact ceiling while holding the same runtime read fence that pins the
snapshot height and AppHash. Consensus cannot publish newer governance state
between the compatibility decision and the verified recovery snapshot.

v11.19.3 acquired those two read fences separately. Its snapshot was coherent,
but a concurrent Commit could make the preceding compatibility verdict stale.
Personal single-node installs still upgrade normally in the app: v11.19.3 and
v11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create
an unsupported app-v28 transition, and the updater performs the recovery
snapshot, coordinated stop, final stopped-state snapshot, install, rollback,
and restart automatically. No CLI or manual preflight is required. The
stopped-node procedure in [`docs/UPGRADING.md`](docs/UPGRADING.md) is only for
quorum or externally managed nodes where an operator can mutate governance
during the v11.19.3 check-to-fence window.

This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.4`. SDK 11.19.4.

## What's New in v11.19.3

**Normal upgrades now preserve compatible governance state automatically.**
The desktop updater reads the canonical pending plan and active proposal under
one runtime-consistent view before changing the executable. A supported
in-flight upgrade is included in the existing verified recovery snapshot and
continues after restart; it is not a reason to interrupt the user or block the
update. No terminal command, preflight ceremony, or governance expertise is
required.

Malformed canonical state, an undecodable upgrade ballot, or a target newer
than this binary supports still fails closed before executable mutation. The
technical `upgrade status` and stopped-node `upgrade preflight` commands remain
available for headless and quorum operators. **Superseded safety notice:** the
v11.19.3 live updater did not hold one uninterrupted fence across that check and
snapshot capture. That does not impose a CLI step on a personal node; only
quorum or externally managed governance needs the coordinated stopped-node
procedure when leaving v11.19.3.

This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.3`. SDK 11.19.3.

## What's New in v11.19.2

**Binary replacement now has consensus-authoritative upgrade-governance
proof.** The read-only `/upgrade/governance-status` ABCI query reports the
current application version, the exact pending `upgrade:plan` record, and the
canonical `state:gov:active` proposal. Upgrade ballots include their decoded
target application version. Storage, pointer/proposal identity, bounds,
canonical-name, status, height, and payload-decode failures return ABCI code 1
instead of being misreported as an empty plan or ballot.

`sage-gui upgrade status` now consumes that fail-closed query rather than
inferring safety from `/abci_info` plus the off-chain dashboard projection. The
stopped-node `sage-gui upgrade preflight` command uses the same canonical
inspector before the new server starts. v11.19.3 integrates that compatibility
decision into the normal updater and lets supported in-flight operations
continue automatically.

This patch changes no consensus rule, AppHash input, transaction type, key
encoding, fork target, or application version. Existing app-v27 chains replay
byte-identically.

Container: `ghcr.io/l33tdawg/sage:11.19.2`. SDK 11.19.2.

## What's New in v11.19.1

**Stranded message claims remain recoverable beyond the retained-history
window.** `sage_inbox` now embeds the first passive, payload-free page of
unfinished claims held by another runtime sharing the same exact agent identity.
Agents can continue through every older page with
`sage_message_history(folder="claimed_elsewhere")`, then deliberately transfer
an exact claim through the existing compare-and-swap `sage_message_handoff`
path after deciding that its former claimant is dead or stale.

The recovery projection exposes only the message ID, claimant-session fence,
timestamps, and local/federated classification needed for safe handoff. It does
not expose sender identity, intent, payload, result, provider, or chain IDs.
Expired TTL-bounded claims are also excluded consistently from both the exact
diagnostic count and its recovery pages before the periodic expiry sweep runs.

Provider-addressed compatibility messages now bind atomically to the exact
claiming agent and MCP session, resurface on later polls, support CAS handoff,
and complete idempotently through `sage_message_reply`. A failed reply explicitly
does not authorize creating a substitute `sage_message_send`; agents must recover
the original claim or report the failure. Existing claimed provider rows receive
an off-chain SQLite `legacy` session fence during startup migration.

This patch introduces no consensus change or application-version increase. The
supported consensus ceiling remains app-v27.

Container: `ghcr.io/l33tdawg/sage:11.19.1`. SDK 11.19.1.

## What's New in v11.19.0

**Record authors regain lifecycle authority in reserved shared namespaces.**
After app-v27 activates, the immutable author of a record in `general`, `self`,
`meta`, or `sage-*` may challenge that record and may reinstate its open
challenge without separately holding a level-3 Modify grant. The exception is
record-scoped and does not apply to governance-promoted shared domains. Pending
or inactive enrollment, read-only/profile restrictions, shared-write denies,
and classification/clearance failures still deny the action. App-v21 weighted
challenge rounds include the eligible record author in their frozen electorate.

**Omitted task status now has one canonical meaning.** After app-v27, a signed
new-task request that omits `task_status` is canonicalized to `planned` by both
REST transaction construction and consensus proof verification. Pre-app-v27
chains retain the historical requirement to send `task_status: "planned"`
explicitly, preserving replay and AppHash compatibility.

App-v27 is a governed consensus upgrade from app-v26 with no state migration.
Its rules begin at H+1 after activation; older blocks replay under their original
application version.

Container: `ghcr.io/l33tdawg/sage:11.19.0`. SDK 11.19.0.

## What's New in v11.18.28

**Reserved shared domains are readable again without becoming ownable.** Active
local principals can read the compile-time shared namespaces `general`, `self`,
`meta`, and `sage-*`, while each record's classification still applies. This
restores the shared-domain behavior expected by existing agents without opening
private or restricted records.

Access-grant transactions now reject attempts to register either those reserved
namespaces or governance-promoted shared domains as owned domains. REST reports
that conflict as a forbidden request, and the API, SDK, and RBAC references now
state the same contract.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.28 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.28`. SDK 11.18.28.

## What's New in v11.18.27

**Empty semantic recall now distinguishes genuine absence from an incomplete
vector-space view.** For an empty, domain-scoped semantic query, `index_status`
reports `complete`, `incomplete`, or fail-closed `unavailable` only when the
caller and exact query universe support that conclusion. The same signal is
relayed through `sage_recall` and `sage_turn`, so write-on-absence agents can
avoid manufacturing duplicates when committed memories are temporarily
unreachable in the active embedding space.

The proof is caller-safe and race-fenced across canonical projection, SQL,
embedding-space, and vault generations. Narrowed or federated queries and
unhealthy projections never receive a false completeness claim, while bounded
indexed probes keep the empty-result path operationally safe.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.27 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.27`. SDK 11.18.27.

## What's New in v11.18.26

**The supported Go dependency baseline is refreshed.** This release carries
the validated `testify` 1.12.0, `x/crypto` 0.55.0, and `x/tools` 0.49.0 module
updates already exercised by the full repository gate.

**Code scanning and native-shell CI actions are refreshed to their pinned
current revisions.** CodeQL runs with the updated action bundle and the native
shell cache action is updated, without changing SAGE runtime behavior.

**HTTP MCP tokens now bind to existing approved managed identities.** On
app-v23 nodes, token creation no longer generates an unapprovable pending
principal: Root/Admin selects an active ordinary agent already managed by the
node, and issuance fails closed if its exact key is unavailable. The CLI also
handles `mcp-token create --help` without minting a credential and rejects
unknown creation flags.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.26 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.26`. SDK 11.18.26.

## What's New in v11.18.24

**Federated inbox work now has recoverable, session-fenced ownership.** SAGE
binds an inbound federated claim to the receiving MCP session before exposing
its payload. Retained older claims receive an explicit `legacy` CAS fence for
deliberate handoff; live work is never stolen by a timeout. Reply completion,
the claimant check, encrypted result fingerprint, and durable return event now
commit atomically, so a lost-response retry returns the original event while a
different second reply conflicts.

**MCP boot guidance no longer rides inside ordinary tool results.** Lifecycle
standing stays in `initialize.instructions`, including for a client that
initializes after its first tool call. The former imperative block that asked an
agent to invoke tools and edit a memory file has been removed, keeping the inbox
trust boundary internally consistent.

**Embedding-space and retention diagnostics are more precise.** The readiness
guard labels only a qualified-versus-bare spelling of the same provider/model
leaf/dimension as a likely alias, without collapsing two organizations that
publish the same basename. Durable-until-handled presentation is limited to
actionable pending/claimed work, while mixed-version retention-only responses
remain compatible.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.24 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.24`. SDK 11.18.24.

## What's New in v11.18.23

**Turn-time recall now carries the same trust and lifecycle evidence as explicit
recall.** `sage_turn` includes each recalled memory's `corroboration_count` and
`status`, so the every-turn path no longer hides corroboration weight or whether
a recalled row is committed or currently challenged.

**Embedding-space drift is visible before it silently empties semantic recall.**
At boot, SAGE compares the active embedder with the non-deprecated vector spaces
already in the local store. A mismatch produces a loud warning and a structured
`embedding_space` block in `/ready`; the node remains available by default while
strict readiness returns 503, allowing an intentional re-embed migration to
finish instead of turning a quality warning into an outage.

**Managed reranker setup now diagnoses incompatible prebuilt engines.** After a
verified install, SAGE preflights `llama-server`. Proven GLIBC, GLIBCXX, or CXXABI
loader failures preserve the loader's real error and point operators to the
bring-your-own reranker path instead of reporting a successful unusable install.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.23 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.23`. SDK 11.18.23.

## What's New in v11.18.22

**A missing optional ForceGraph API can no longer strand CEREBRUM after the
verified brain has rendered.** The renderer now publishes the core graph and
truthful counts before optional anatomical, control, and interaction setup. The
bundled runtime's absent `clickAfterDrag` helper is feature-gated, so the brain
hull, controls, and auto-rotation continue instead of falling into the cold
unavailable path with real nodes already on screen.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.22 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.22`. SDK 11.18.22.

## What's New in v11.18.21

**A domain-summary refresh can no longer cover a verified MRI graph.** The MRI
renderer is now the sole authority for the central unavailable overlay. Domain
inventory failures stay localized to their own retrying panel, while genuine
cold graph failures and unsafe mode switches remain fail-closed.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.21 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.21`. SDK 11.18.21.

## What's New in v11.18.20

**A transient MRI refresh no longer hides a graph CEREBRUM has already
verified.** Memory and Connectome snapshots now retain their explicit source
mode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible
only when it belongs to that same mode, while retrying in the background. Cold
failures and failed mode switches still fail closed, so Connectome bytes can
never masquerade as a verified memory projection.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.20 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.20`. SDK 11.18.20.

## What's New in v11.18.19

**Codex project hooks stay inside their project.** The v11.18.18 byte-exact
self-healer could mistake Codex's user-global `~/.codex` configuration directory
for a project and generate a global `hooks.json`. That made an unrelated Codex
task receive SAGE inbox Stop nudges for the shared agent identity. The healer now
refuses the user-home/global scope; project-local hooks continue to self-repair.

**Connectome clicks now have one hit-tested owner.** The redundant DOM click
fallback that raced ForceGraph's deferred node click is gone. Small pointer
wobble is handled by one explicit tolerance, background dismissal uses the
graph's raycast result, and clicking a second neuron no longer closes the
inspector and starts a competing zoom-out first. Raw domain-access metadata is
summarized behind a bounded disclosure below traffic, relationships, and memory
details; bloomed memory nodes now expose hover and accessible click feedback.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.19 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.19`. SDK 11.18.19.

## What's New in v11.18.18

**Codex upgrades now repair stale SAGE lifecycle hooks automatically.** On
every MCP startup, the project self-healer compares all five installer-owned
Codex hook scripts with their fully rendered current templates. A mixed
generation can no longer pass merely because the files exist or another hook
mentions the current binary. Upgrading therefore replaces legacy no-op Stop
hooks and malformed prompt hooks without requiring a second manual
`sage-gui codex install` run.

**The CEREBRUM Connectome now leads with the graph itself.** Neurons have a
larger practical click target; clicking one opens its persistent identity,
visible incoming/outgoing traffic, strongest peer, directed connection list,
and visible memory lobe. The compact fallback selector now shows only agents
with visible peer relationships, ordered by retained traffic, instead of
turning a large dormant/test roster into the primary navigation surface.
Isolated authorized neurons remain visible and clickable in the brain and join
the selector while selected.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.18 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.18`. SDK 11.18.18.

## What's New in v11.18.17

**Routine MCP restarts no longer make the same stdio agent disown its own
unfinished messages.** The primary stdio runtime now persists one opaque
claimant identity per exact signed agent, provider, and project under
`SAGE_HOME`, and holds an OS advisory lock as the liveness fence. A later
runtime reuses that identity only after the earlier process is no longer live;
a genuinely concurrent runtime receives an independent identity and retains
the existing one-handler and compare-and-swap handoff boundary. In-place
installed-binary handoff also carries the current claimant identity while the
old process keeps the lock alive.

The fix is deliberately prospective and does not bulk-transfer historical
claims created by pre-v11.18.17 random process identities. Those rows remain
visible through `claimed_elsewhere_count` and passive history and can still be
transferred one at a time with the existing CAS-fenced handoff after the old
claimant is known dead. HTTP MCP conversations remain transport-scoped. This
patch introduces no new consensus application version or state migration. The
ceiling remains app-v26; **v11.18.17 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.17`. SDK 11.18.17.

## What's New in v11.18.16

**Claimed agent work no longer disappears from the inbox that claimed it.**
`sage_inbox` now returns a separate bounded `own_claimed_unfinished` projection
for messages already owned by the exact current agent session. The projection
is passive: it never claims, refreshes, transfers, or duplicates work, and it
does not change the established `items` or `count` meaning of newly available
work. Exact agent/session filtering, completion and expiry handling, bounded
results with an exact total, reply-after-repoll, and nonmutation are pinned by
store, REST, and MCP regression coverage.

The payload-free hook status path also checks the durable wake snapshot, so
claimed-but-unfinished work cannot be reported as a clean inbox merely because
no unclaimed row remains. Older or temporarily incapable nodes degrade to an
explicit `unavailable` state instead of either a false zero or a failed primary
inbox call. This patch does not automatically transfer claims from another
session; passive history plus explicit compare-and-swap handoff remain the
recovery boundary. It introduces no new consensus application version or state
migration. The ceiling remains app-v26; **v11.18.16 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.16`. SDK 11.18.16.

## What's New in v11.18.15

**Every unfinished exact-recipient local canonical message now has a durable
wake generation, including upgrade-era claimed-only work and sends through the
deprecated pipe route.** Startup backfill covers both pending and claimed rows, so a recipient
whose only live work was already claimed cannot reopen as the silent
`{seq:0,pending:true}` state. Keyed exact-local pipe sends use the canonical
idempotent admission path; unkeyed sends insert the row and advance the same
recipient sequence atomically. Publication happens only after commit, exact
replays do not republish, and an incapable backend fails before insertion rather
than creating durable work that wake consumers cannot observe as new.

The experimental Claude notification adapter is explicitly opt-in again. The
shipped Claude Code host registers the custom notification handler, but
end-to-end delivery from a plain `.mcp.json` server through its plugin-scoped
gate remains unverified. An idle adapter would also acquire the one exact-agent
wake lease and exclude a useful long-running consumer.
`SAGE_CLAUDE_CHANNEL=true` enables it for an operator who has confirmed that
delivery path.

Pending-memory presentation is deterministic even when creation timestamps tie:
SQLite and PostgreSQL both use `memory_id` as the final ordering key. The
documentation citation guard now parses newline-separated and hyphenated paths,
pins every concrete declaration/lead/interior anchor, repairs only explicitly
accepted declaration anchors, refuses semantic locations it cannot reconstruct,
and inventories the remaining legacy skipped and bare references. This patch
introduces no new consensus application version or state migration. The ceiling
remains app-v26; **v11.18.15 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.15`. SDK 11.18.15.

## What's New in v11.18.14

**Durable agent messages now stay visible until the work is actually
finished.** Claiming a message no longer makes the payload-free wake surface go
quiet: both pending and claimed rows remain unfinished, a reconnect at the
current cursor receives an immediate wake, and `sage_inbox` reports an exact
payload-free claimed-elsewhere state instead of a bounded-scan false zero.
Claude Code project sessions arm the signed wake channel by default, while the
optional Stop hook reads a lease-free monotonic snapshot so new or stranded
work can nudge a session once without stealing the live SSE consumer lease.

The same recovery path is honest at its edges. A claimant-session fence
rejection remains a typed conflict instead of masquerading as a missing
message, and history plus explicit compare-and-swap handoff remain the only
way to recover another session's claim. Canonical retention migration now
rescues only the exact historical 24-hour stamp, preserving a sender's chosen
bounded TTL across every store reopen, including RFC3339 nanosecond timestamps.

**CEREBRUM's Connectome now identifies the agents it renders.** Hover details
are positioned and escaped reliably, while click, tap, and keyboard selection
open one persistent inspector with exact agent identity, visible retained
traffic, peers, activity, and an independently loading visible-memory lobe.
Selection survives authorized live refreshes, error and empty states stay
truthful, mobile uses a bounded sheet, and reduced-motion and established
Connectome guidance remain intact.

Agent-as-lobe corroborator reads now use one deterministically ordered bounded
batch instead of an N+1 query pattern, with matching SQLite and PostgreSQL
ordering. The MCP contract also states the server-enforced 31-day
`sage_timeline` range rather than advertising requests the server rejects.
This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.14 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.14`. SDK 11.18.14.

## What's New in v11.18.13

**Hubanov's distributed-engram contribution now connects memories to the
neurons that corroborated them.** CEREBRUM keeps agent and memory identities in
separate graph namespaces, rejects stale bloom generations, and removes every
transient bridge on focus or graph replacement. The server uses a deterministic,
indexed 96-row evidence prefix and exposes at most 12 authorized bridges without
turning historical corroboration into a claim of current possession.

**Claude's production wake source can now arm the payload-free message bus.**
When explicitly enabled with `SAGE_CLAUDE_CHANNEL`, the MCP runtime consumes the
existing signed SSE wake route with a random process lease and resumable cursor.
Delivery applies backpressure instead of dropping the newest wake, and shutdown
releases saturated readers without leaking goroutines or claiming message
content.

**The Connectome no longer floats an instructional card over the brain.** Its
guidance lives in the existing reading panel, the mode toggle keeps one stable
name and visible pressed state in both themes, keyboard focus remains clear,
mobile Reset behavior stays intentional, and view changes are announced to
assistive technology.

This patch also closes a claimant-session compatibility bypass: a current typed
404 is authoritative, the deprecated pipe-result alias carries the active MCP
session, and only a genuine old-node route miss may fall back. It introduces no
new consensus application version or state migration. The ceiling remains
app-v26; **v11.18.13 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.13`. SDK 11.18.13.

## What's New in v11.18.12

**CEREBRUM can now open an agent as a memory lobe.** Selecting a connectome
neuron lazily blooms that agent's highest-confidence visible memories as
engrams, while retaining the operator-only route and app-v23 per-record
projection checks. The indexed, bounded query avoids whole-brain scans; stale,
failed, and disposed frontend requests cannot leave another agent's lobe on
screen.

**Dashboard live activity is now guarded as one exact 20-event registry.** The
seven previously unwired operator events now reach the existing dashboard SSE
stream, while message wake, MCP, and wizard protocols stay route-local. A
fail-closed typed control-flow audit and executable browser contract reject
dead, aliased, escaped, build-tagged, or decoy event sinks.

**Signed task creation and message attribution now agree end to end.** Every
official task constructor explicitly signs the required initial `planned`
status, and REST fails fast instead of mutating an omitted signed field into a
transaction that app-v23 through app-v26 must reject. Authorized message and
pipe responses retain exact immutable agent IDs alongside mutable presentation
labels, use one bounded batch metadata query on healthy production stores with
a bounded exact-ID fallback, suppress foreign-chain label collisions, and keep
count-only responses identity-free.

This patch also repairs release-facing documentation drift, pins the current
33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the
references it can verify. It introduces no new consensus application version
or state migration. The ceiling remains app-v26; **v11.18.12 introduces no
app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.12`. SDK 11.18.12.

## What's New in v11.18.11

**The CEREBRUM connectome now fires live without widening its operator-only
boundary.** Successful local message sends emit a contentless invalidation tick;
the browser then refetches the existing caller-filtered snapshot and pulses only
newly observed synapses. Monotonic generations preserve later ticks across
in-flight requests, ordinary reloads, failures, and retries, while initial loads
and unrelated refreshes never create false activity.

**Dashboard retrieval activity no longer duplicates authorized memory plaintext
into the global operator stream.** Recall, search, and hybrid events now expose
only their event type and result count. The obsolete expandable plaintext panel
is gone, and serialized-frame regressions pin the contentless contract and live,
non-replayed delivery.

**Claude bookend sessions can discover waiting SAGE messages without claiming or
revealing them.** A signed, payload-free inbox-status hook reports only the
current identity and unread count, makes failures visible, preserves unrelated
user hooks during self-heal, and exposes the read-only message tools needed to
perform the explicit inbox fetch.

This patch also keys local connectome locality by chain identity, removes a stale
app-v7 validator warning after app-v14, dims the connectome skull for legibility,
requires patched Go 1.25.13 throughout current builders and CI, and publishes
checksum sidecars for Windows executables. It introduces no new consensus
application version or state migration. The ceiling remains app-v26;
**v11.18.11 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.11`. SDK 11.18.11.

## What's New in v11.18.10

**Multiple MCP runtimes sharing one agent identity can no longer silently lose
track of claimed messages.** Every MCP conversation now has an opaque claimant
session ID. Atomic inbox claims persist that session in passive history, an
explicit compare-and-swap handoff transfers work between runtimes, and a stale
former owner is rejected if it tries to reply after ownership moved. Receive
tokens remain replay-safe after a lost response, while legacy direct REST
clients retain their existing agent-level compatibility path.

**CEREBRUM can render the agent message bus as a live connectome inside the 3D
brain.** Registered agents become domain-coloured neurons, directed channels
become traffic-weighted synapses, and hub agents settle toward the core. The
view consumes the existing RBAC-filtered synapse projection, drops ghost edges,
and fences asynchronous mode switches so a slow memory response can never be
displayed as connectome data.

**Upgrade-watchdog submissions can no longer hold a signing key's nonce lease
for the process lifetime when CometBFT wedges.** One bounded context now covers
both lease acquisition and the broadcast. A deadline after submission remains
a typed indeterminate outcome, so the exact signer and bytes stay fenced until
their fate is reconciled; elapsed time never releases the key fail-open.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.10 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.10`. SDK 11.18.10.

## What's New in v11.18.9

**Ambiguous CometBFT commit and sync outcomes are now typed at the shared
broadcaster boundary.** Transport, status, RPC, decode, shape, hash-binding, and
missing-height failures return `ErrSubmitIndeterminate` for valid signing keys,
while the existing live-registration path remains an independent fence
backstop. Pre-send request-construction failures remain definitive and do not
fence a key over bytes that never reached a transport.

**Federation sync now fails closed if its commit broadcaster ever violates its
contract by returning neither a result nor an error.** The exact signer and
encoded transaction remain fenced until reconciliation proves their fate,
instead of releasing the key for a potentially in-flight transaction. A new
cross-package decoder contract also pins the HTTP prologue shared by
`internal/tx` and the CEREBRUM web path while recording their deliberate verdict
and envelope-tolerance differences.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.9 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.9`. SDK 11.18.9.

## What's New in v11.18.8

**CometBFT transaction submissions no longer permit Go's HTTP transport to
transparently redeliver a fenced request after a reused connection fails while
reading the response.** Commit, sync, byte-identical nonce-fence reconciliation,
and CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam.
Each submission call writes its transaction on one connection and returns an
indeterminate result instead of silently delivering the same signed bytes to a
second responder. Restart failure reporting also preserves the signer-fence
veto ahead of a generic drain timeout.

**MCP reply polling now fails safe when a caller presents an unsafe forward
watermark.** If `reply_since` is later than the authoritative retained-reply
head, or no head exists to validate it, `sage_inbox` returns the newest passive
reply page for deduplication instead of filtering a formal reply into a false
empty result. Complete recovered pages become a new safe baseline; truncated
pages require composite-cursor catch-up, and failed page reads never claim
recovery. A successful outbound `sage_message_send` also performs one bounded,
sender-exact passive inbox snapshot so an inbound message that arrived after an
earlier empty poll is surfaced during continued coordination.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.8 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.8`. SDK 11.18.8.

## What's New in v11.18.7

**Large signed transactions now use a bounded CometBFT transport instead of
overflowing request headers.** Existing smaller broadcasts keep the established
GET wire shape, while large commit, sync, and byte-identical nonce-fence
reconciliation requests use JSON-RPC POST with base64 transaction bytes. Client
transaction and JSON-RPC body limits are independently range-checked, capped at
8,000,000 bytes, and refuse an oversized request before send. Operators raising
them must configure matching CometBFT limits. Independently, every validator
enforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic
finalization, sufficient for the measured 1,304-entry SkillRegistry transaction.
Memory content remains bounded at 512 KiB, while the canonical signed
`AgentRequest` proof has its own 600,000-byte consensus bound, admitting the
measured 573,723-byte proof without widening the content or aggregate limits.
Response handling accepts strict quoted or numeric `int64` heights, rejects
fractional, exponent, null, malformed, and out-of-range heights, and refuses
unsupported content types.

**Federation route refresh no longer risks recursively acquiring the
sync-policy read lease from a peer-request caller.** Opportunistic refresh
admission is policy-free and bounded to one pending refresh per peer; the
agreement and binding lookup runs asynchronously after the request caller can
release its lease. Failed-request and successful-Direct triggers remain
covered, while the route-exchange endpoint does not self-trigger refresh.

**P2P-only peers can recover when their stored route snapshot is missing or
belongs to an older trust generation.** Only the authenticated
`/fed/v1/p2p/routes` bootstrap exchange may use stale or current route addresses
as connection hints; the current agreement's pinned mTLS identity remains
authoritative. Protected requests reject missing or cross-generation snapshots
with `trust_generation_mismatch`. A matching-generation empty target set remains
explicitly pinned and cannot fall back to current configuration.

**Federation diagnostics now give security evidence precedence over route
availability evidence.** Mixed route-availability plus certificate, SPKI, pin,
identity-mismatch, or security-block evidence is classified as
`security_blocked`; revocation, expired or unknown agreement, trust-failure, or
authentication evidence is classified as `trust_failure`. Both verdict classes
outrank route availability.

This patch introduces no new consensus application version or state migration.
The ceiling remains app-v26; **v11.18.7 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.7`. SDK 11.18.7.

## What's New in v11.18.6

**Updater snapshots now prove both supported CometBFT layouts before they are
published or reused.** Application Badger and persisted consensus state must
match at height `H` and agree on the application hash. A blockstore committed
through `H` is accepted only after its `H` block ID and seen commit match that
state. If the blockstore is durably one block ahead at `H+1`, SAGE additionally
verifies the complete block and part identity, direct-parent and state-derived
header fields, last and seen commits, validator signatures, and CometBFT's
replay-time block validation. Regression coverage restores the candidate and
runs the real CometBFT handshaker, proving exactly one replayed block and safe
restart reuse. Malformed or more-than-one-ahead provenance is rejected, and an
invalid prior publication is quarantined before a valid replacement can be
published. Cancellation always blocks executable updater handoff, although a
safe snapshot may already have been atomically published. Non-empty `H+1`
evidence is retryable until application and state catch up.

**Federation Retry now performs one bounded, exact-generation recovery
workflow.** Concurrent operator clicks share the same route refresh and
authenticated status probe. Direct and relay targets are frozen to the active
JOIN generation, HTTP `401`/`403` and certificate/identity failures stop before
re-probing, and a revoke or re-pair during the response invalidates the result.
Typed dashboard diagnostics distinguish missing or expired route bundles,
stale Direct routes, unavailable relays, trust-generation changes, and legacy
connections that must be paired again. Ordinary polling and mutating requests
do not enter this retry path.

**Memory-reassignment audit failures no longer place request-controlled agent
IDs in logs.** The source and target are represented by fixed 96-bit truncated
SHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable
incident correlation without allowing CR/LF or other control characters to
forge log records.

This patch does not change consensus state or application activation. The
ceiling remains app-v26; **v11.18.6 introduces no app-v27**. The signer fence
also remains process-local: unresolved submissions still require proof of fate,
and crash/restart or a separate signing process is not claimed safe until
durable cross-process pre-broadcast intent exists.

Container: `ghcr.io/l33tdawg/sage:11.18.6`. SDK 11.18.6.

## What's New in v11.18.5

**Long-lived stdio MCP sessions now follow an installed SAGE upgrade without
executing a request under stale tools.** The MCP process snapshots the exact
executable that started it. If the app bundle or binary is atomically replaced,
the next unread JSON-RPC frame is handed to the new executable together with
the remaining stdio stream. The upgraded runtime—not the stale process—receives
that request. The old runtime never executes the handed-off frame; transport
failure remains an ordinary indeterminate outcome for callers to reconcile.
Sessions initialized on 11.18.5 advertise MCP tool-list change support; the
replacement emits `notifications/tools/list_changed` only after the logical
session has completed initialization, so conforming clients refresh cached
definitions as well as runtime behavior.

**The unified coordination response identifies its live contract.** Every
`sage_inbox` result now carries `coordination_schema: "sage.inbox.v2"`, the
running `mcp_runtime_version`, and `sender_replies_embedded: true|false`. Monitors can
therefore reject or report a stale pointer-only session instead of silently
assuming that an empty addressed inbox also means no threaded reply arrived.
The existing bounded `reply_items`, inclusive watermark, composite catch-up
cursor, and passive sender-only authorization remain unchanged.

The upgrade from a pre-11.18.5 MCP process still requires one agent-session
restart because that already-running older process cannot contain this handoff
logic. Once a session starts on 11.18.5 or later, subsequent binary replacements
use the automatic request-preserving handoff. Clients that ignore the negotiated
tool-list notification must still re-list tools or reconnect to discover new
definitions.

The consensus ceiling remains app-v26; **v11.18.5 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sage:11.18.5`. SDK 11.18.5.

## What's New in v11.18.4

**One inbox poll now surfaces both new work and threaded answers.**
`sage_inbox` returns replies to messages you sent under the separate passive
`reply_items` key by default, while genuine inbound work remains under `items`.
Reply rows never inflate work counts and explicitly require no reply. Inclusive
`reply_since` polling prevents same-millisecond loss; truncated pages fail safe
with an exact composite-cursor catch-up action and forbid advancing the
watermark until the window is drained.

**Release builders now enforce the patched Go floor.** Root and `natter`
modules require Go 1.25.12, CI and release jobs resolve that exact `go.mod`
toolchain, every Go container builder uses 1.25.12, and pinned
`govulncheck v1.6.0` scans both modules before either CI fan-in or release
publication can pass.

**Legacy pipeline retention compares time chronologically and conservatively.**
SQLite purge eligibility no longer relies on variable-width RFC3339 text.
Cutoffs are floored to SQLite's millisecond precision, so ambiguous
same-millisecond rows are retained rather than deleted early; malformed read
evidence also retains fail safe.

The consensus ceiling remains app-v26; **v11.18.4 introduces no app-v27**.

Container: `ghcr.io/l33tdawg/sa

io.github.l33tdawg/sage

About

Details

README

More