diff --git a/.ai/handoff/CURRENT_STATE.md b/.ai/handoff/CURRENT_STATE.md index 2636aa0c..bcfe9cbe 100644 --- a/.ai/handoff/CURRENT_STATE.md +++ b/.ai/handoff/CURRENT_STATE.md @@ -153,3 +153,7 @@ carried a release-gate step that could not run on a CI runner, so the gate could never pass from that tag, and repository rules correctly refuse both deletion and update of stable tags. No GitHub Release or PyPI artifact was ever created for it. + +## What `v0.15.3` Targets + +`v0.15.3` is the current release candidate. It is not published. diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 172323e8..f397d4f8 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -249,3 +249,5 @@ usage justifies a separately reviewed boundary. `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/CHANGELOG.md b/CHANGELOG.md index abf25012..c02a1dfc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,23 @@ ## Unreleased +## v0.15.3 — 2026-08-15 + +- First release published from `samrusani/AliceMemory`. Project URLs corrected; + documents under `docs/release/` and `docs/archive/` intentionally keep the + former name, since they describe artifacts signed from it. +- setuptools 83 to 84 for the build backend. Wheel records + `Generator: setuptools (84.0.0)`, metadata version unchanged at 2.4. +- twine constraint widened to `<8.0` and exercised against the release artifacts. +- All three CodeQL action pins moved to v4.37.4 together; they cannot move + separately without CodeQL refusing to run. +- pnpm setup action pin converted from a tag-object SHA to the equivalent + commit SHA. +- `@testing-library/react` 16.3.2. +- Corrected four references to systemd units that are not shipped. + +No functional change to the library. No migration, no schema change. + - The repository was renamed from `samrusani/AliceBot` to `samrusani/AliceMemory` on 2026-08-14, matching the `alice-memory` package name and the alicememory.com domain. Documents under `docs/release/` and diff --git a/CURRENT_STATE.md b/CURRENT_STATE.md index 2636aa0c..bcfe9cbe 100644 --- a/CURRENT_STATE.md +++ b/CURRENT_STATE.md @@ -153,3 +153,7 @@ carried a release-gate step that could not run on a CI runner, so the gate could never pass from that tag, and repository rules correctly refuse both deletion and update of stable tags. No GitHub Release or PyPI artifact was ever created for it. + +## What `v0.15.3` Targets + +`v0.15.3` is the current release candidate. It is not published. diff --git a/PRODUCT_BRIEF.md b/PRODUCT_BRIEF.md index 6f1da31c..1c52f043 100644 --- a/PRODUCT_BRIEF.md +++ b/PRODUCT_BRIEF.md @@ -65,3 +65,5 @@ Agent developers — people building or operating AI agents who need durable, ex `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/README.md b/README.md index 453594c9..db21b546 100644 --- a/README.md +++ b/README.md @@ -203,3 +203,5 @@ MIT — see [LICENSE](https://github.com/samrusani/AliceMemory/blob/main/LICENSE `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/RELEASING.md b/RELEASING.md index 6987ca83..8932e90f 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -407,3 +407,5 @@ macOS with `shasum -a 256 -c SHA256SUMS`. `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/ROADMAP.md b/ROADMAP.md index 26e82b5b..2ab32b4a 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -87,3 +87,5 @@ restore, recorded security disposition) shipped in Phases 4 and 5. `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/apps/web/package.json b/apps/web/package.json index 33048e80..7816d3df 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -1,7 +1,7 @@ { "name": "@alicebot/web", "private": true, - "version": "0.15.2", + "version": "0.15.3", "packageManager": "pnpm@10.23.0", "scripts": { "dev": "next dev", diff --git a/docs/release/v0.15.3-release-notes.md b/docs/release/v0.15.3-release-notes.md new file mode 100644 index 00000000..a8567114 --- /dev/null +++ b/docs/release/v0.15.3-release-notes.md @@ -0,0 +1,86 @@ +# Alice v0.15.3 Release Notes + + +**A maintenance release. The repository moved to `samrusani/AliceMemory`, and +this is the first version published from it.** + +There are **no functional changes** to the library. If you are running +`v0.15.2`, nothing in your deployment behaves differently after upgrading, and +there is no reason to hurry. + +If you are running `v0.14.0` or earlier, take `v0.15.2` or later promptly: those +releases added agent-key authentication to `/v1`, which had none before. + +## The repository is now `samrusani/AliceMemory` + +The project name, the PyPI package `alice-memory`, and the domain +alicememory.com all agreed with each other. The repository did not. It does now. + +Every link in this release points at the new location. GitHub redirects the old +name, so existing clones, bookmarks and scripts keep working, but a redirect +lasts only until someone creates a repository at the freed name, so the +published metadata is corrected here rather than left to depend on it. + +Documents under `docs/release/` and `docs/archive/` deliberately keep the former +name. They describe artifacts that were built and signed from it, and PyPI's +attestations bind those bytes to the old repository permanently. Rewriting them +would put a document in conflict with the signed record of the artifact it +describes. + +## Build and CI maintenance + +- setuptools moves 83 to 84. The build output was checked rather than assumed: + the wheel records `Generator: setuptools (84.0.0)` and the metadata version is + unchanged at 2.4. +- The twine constraint widens to `<8.0`. twine 7.0.0 was published on + 2026-07-27, so this admits it immediately rather than pre-authorising + something hypothetical, and it was exercised against these artifacts before + the change landed. +- All three CodeQL action pins move to v4.37.4 together. They cannot move + separately: CodeQL refuses to run when its steps disagree on version. +- The pnpm setup action pin converts from a tag-object SHA to the equivalent + commit SHA. Same code, more conventional and auditable form. +- `@testing-library/react` moves to 16.3.2, a development dependency. + +## Documentation corrections + +Four references to systemd units that were never shipped are corrected. The +packaged units are `alice-api.service`, `alice-scheduler.service` and +`alice-web.service`; two guides named `alicebot-*` variants that do not exist +and would have sent a self-hoster looking for units that were never installed. + +## Compatibility + +No database migration. No schema change. No API change. No behaviour change. + +The published artifacts are built by a newer setuptools, so their bytes differ +from `v0.15.2` even where the source is identical. That is expected. Verify +against the digests below rather than against any previous release. + +## Known limitations + +Unchanged from `v0.15.2`, and worth repeating because none of them are closed: + +- **`/v1` authenticates but does not authorize.** Every `/v1` request must + present a valid key, and it does not matter which one. A key minted as + `read_only_agent` can bootstrap a workspace, register providers, and supersede + memory over `/v1` exactly as an administrative key can. Profiles are enforced + on `/v0/vnext`, on the MCP tool surface, and in the CLI. **Keep `/v1` + loopback-only.** +- **`/v1` writes are not attributed**, so a quarantine sweep by agent key cannot + reach them. +- **The zero-setup `uvx` path does not produce retrievable memory.** Everything + written through `alice-memory mcp` lands as a review candidate, recall returns + nothing, and there is no approval route on that surface. Use the PostgreSQL + path until this is fixed. +- **Importers trust the directory you point them at.** A local actor with write + access inside a selected import root can reach content outside it, by hard link + or by swapping an ancestor directory between listing and read. +- **Archived import evidence is decoded text, not a byte image.** CRLF sources + archive as LF. + +## Install + +```bash +pip install alice-memory==0.15.3 +``` diff --git a/docs/vnext/README.md b/docs/vnext/README.md index 6320aaca..4bf96bf5 100644 --- a/docs/vnext/README.md +++ b/docs/vnext/README.md @@ -84,3 +84,5 @@ promotion of generated artifacts into trusted memory. `v0.15.2` is the latest published release and remains the install, checksum, and baseline reference. + +`v0.15.3` is the current release candidate. It is not published. diff --git a/pyproject.toml b/pyproject.toml index ac026f26..2175c96c 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "alice-memory" -version = "0.15.2" +version = "0.15.3" description = "Alice: the continuity layer for AI agents. Local-first memory with provenance, open loops, resumption, and review-governed writes." readme = "docs/pypi-description.md" license = "MIT"