audrey 1.0.2 → 1.1.0

package/docs/paper/output/submission-bundle/docs/paper/audrey-paper-v1.md

@@ -841,11 +841,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 ### MCP, CLI, and REST Surfaces
 
-The MCP server registers 20 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote` (Ledger: E32). The Guard-relevant MCP surface is `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`, with `memory_validate` supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with `--hook`. `hook-config claude-code --apply` merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact` (Ledger: E34). The `guard` subcommand remains available for explicit checks, while the host-facing `hook` subcommand normalizes current Claude Code and Codex lifecycle payloads. `audrey install --host auto` discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through `/hooks` (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by `session_id + tool_use_id`; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as `unknown` unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through `AUDREY_HOOK_FAIL_CLOSED=1`. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless `AUDREY_ENABLE_ADMIN_TOOLS=1` (Ledger: E33).
 
 ### Configuration
 
@@ -895,13 +897,13 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 ### Behavioral Regression Result
 
-The current `benchmarks/output/summary.json` was generated on 2026-05-29T03:45:32.997Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
+The current `benchmarks/output/summary.json` was generated on 2026-07-10T15:00:37.705Z with command `node benchmarks/run.js --provider mock --dimensions 64` (Ledger: E24). It reports:
 
 | System | Score Percent | Pass Rate | Average Duration Ms |
 |---|---:|---:|---:|
-| Audrey | 100 | 100 | 15.416666666666666 |
-| Vector Only | 41.66666666666667 | 25 | 0.3333333333333333 |
-| Keyword + Recency | 41.66666666666667 | 25 | 0.6666666666666666 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
+| Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
 | Recent Window | 37.5 | 25 | 0 |
 
 This output is a regression-gate result. The baselines are toy local baselines used to catch retrieval and lifecycle regressions in the Audrey codebase. They are not external systems, not tuned competitor implementations, and not GuardBench baselines (Ledger: E23-E24). The current suite covers retrieval and operation families such as information extraction, knowledge updates, multi-session reasoning, conflict resolution, procedural learning, privacy boundary, overwrite, delete-and-abstain, semantic merge, and procedural merge (Ledger: E23-E24).
@@ -924,7 +926,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 2.916 ms / 21.17 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |
@@ -1071,7 +1073,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 ### Open Problems
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points [@anthropic2026claudecodehooks]. Audrey now generates and applies Claude Code hook settings, `guard --hook` emits the current PreToolUse `hookSpecificOutput.permissionDecision` shape, and `observe-tool` records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary [@anthropic2026claudecodehooks].
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.
 

package/docs/paper/output/submission-bundle/docs/paper/evidence-ledger.md

@@ -21,7 +21,7 @@ Every implementation claim in the paper should point to one or more ledger IDs i
 | E15 - Recall degradation is represented as `RecallError[]`, propagated through `partialFailure` and `errors`, and exposed in memory status as `recall_degraded` and `last_recall_errors`. | Recall degradation types and status | src/types.ts:129-137,568-570; src/recall.ts:741-753; src/audrey.ts:844-846 | Yes, 2026-05-08 |
 | E16 - Closed-loop validation accepts `used`, `helpful`, and `wrong` outcomes and updates salience, usage count, retrieval count, challenge count, and last-use/reinforcement timestamps by memory type. | Feedback application | src/feedback.ts:3-18,32-45,91-163 | Yes, 2026-05-08 |
 | E17 - Impact reporting computes memory totals, all-time and windowed validation counts, challenge counts, per-outcome validation events, top-used memories, weakest memories, and recent activity. | Impact report | src/impact.ts:12-35,100-158 | Yes, 2026-05-08 |
-| E18 - The MCP surface registers 20 tools; Guard-relevant tools include `memory_observe_tool`, `memory_capsule`, `memory_preflight`, and `memory_reflexes`. | MCP tool surface | mcp-server/index.ts:639-654,1455-2022 | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 20 on 2026-05-08 |
+| E18 - The MCP surface registers 22 tools; Guard-relevant tools include `memory_observe_tool`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, and `memory_reflexes`. | MCP tool surface | mcp-server/index.ts | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 22 on 2026-07-10 |
 | E19 - Audrey exposes `memory_validate`, `memory_dream`, `memory_observe_tool`, `memory_capsule`, `memory_preflight`, and `memory_reflexes` in the server help and registers each as an MCP tool. | MCP guard and lifecycle tools | mcp-server/index.ts:639-654,1456,1779,1835,1905,1944,1982 | Yes, 2026-05-08 |
 | E20 - `benchmarks/snapshots/perf-0.22.2.json` is the canonical performance snapshot generated on 2026-05-01 from git SHA `e2e821b`, using mock in-process 64-dimensional embeddings, hybrid recall limit 5, corpus sizes 100/1000/5000, and 50 recall runs per size on Node 25.5.0 with a 24-core Ryzen 9 7900X3D and 62.9 GB RAM. | Performance snapshot methodology and provenance | benchmarks/snapshots/perf-0.22.2.json:2-16,19-26 | Yes, 2026-05-08 |
 | E21 - The canonical perf snapshot reports hybrid recall p95 of 1.82 ms at 100 memories, 2.364 ms at 1,000 memories, and 3.417 ms at 5,000 memories under the mock-provider methodology. | Performance snapshot recall p95 | benchmarks/snapshots/perf-0.22.2.json:42-44,73-75,104-106 | Yes, 2026-05-08 |
@@ -35,21 +35,21 @@ Every implementation claim in the paper should point to one or more ledger IDs i
 | E29 - Audrey stores episodic, semantic, and procedural memories alongside causal links, contradictions, consolidation runs and metrics, configuration, and tool/memory events in SQLite tables with indexes on created time, source, state, session, tool, and outcome. | Storage schema | src/db.ts:8-158 | Yes, 2026-05-08 |
 | E30 - Audrey creates sqlite-vec virtual tables for episodic, semantic, and procedural embeddings, creates FTS5 virtual tables for the same memory classes, backfills FTS tables, and manages schema evolution through in-code migrations. | Vector, FTS, and migrations | src/db.ts:193-208,318-370; src/fts.ts:15-21,143-159 | Yes, 2026-05-08 |
 | E31 - Audrey's runtime stack is Node 20+, TypeScript, Hono, MCP stdio, better-sqlite3, sqlite-vec, transformers.js local embeddings, and optional OpenAI or Gemini embedding providers. The local provider uses a 384-dimensional `Xenova/all-MiniLM-L6-v2` model; mock, OpenAI, and Gemini default to 64, 1536, and 3072 dimensions respectively. | Runtime stack and embedding providers | package.json:105-115,122; mcp-server/index.ts:1605,2061-2064; mcp-server/config.ts:29-79; src/embedding.ts:39-46,122-180,207-218,288-299 | Yes, 2026-05-08 |
-| E32 - The MCP server registers exactly 20 tools by name: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_reflexes`, and `memory_promote`. | MCP tool registry | mcp-server/index.ts:1455-2022 | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 20 on 2026-05-08 |
-| E33 - The REST sidecar exposes health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting routes; API-key middleware uses bearer-token constant-time comparison, and export/import/forget are disabled unless admin tools are enabled. | REST route surface and auth/admin gates | src/routes.ts:13-61,68-70,135-188,195-494 | Yes, 2026-05-08 |
-| E34 - The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact`. | CLI subcommands | mcp-server/index.ts; tests/mcp-server.test.js | Yes, 2026-05-12 |
+| E32 - The MCP server registers exactly 22 tools by name: `memory_dream`, `memory_encode`, `memory_recall`, `memory_consolidate`, `memory_introspect`, `memory_resolve_truth`, `memory_export`, `memory_import`, `memory_forget`, `memory_validate`, `memory_decay`, `memory_status`, `memory_reflect`, `memory_greeting`, `memory_observe_tool`, `memory_recent_failures`, `memory_capsule`, `memory_preflight`, `memory_guard_before`, `memory_guard_after`, `memory_reflexes`, and `memory_promote`. | MCP tool registry | mcp-server/index.ts | Yes, `rg "server\.tool\(" mcp-server/index.ts` count = 22 on 2026-07-10 |
+| E33 - The REST sidecar exposes health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipt, reflex, consolidation, dream, introspection, impact, truth-resolution, export, import, forget, decay, status, reflection, and greeting routes; API-key middleware uses bearer-token constant-time comparison, and export/import/forget are disabled unless admin tools are enabled. | REST route surface and auth/admin gates | src/routes.ts; tests/http-api.test.js | Yes, focused HTTP API coverage passed on 2026-07-10 |
+| E34 - The CLI recognizes `install`, `uninstall`, `mcp-config`, `hook-config`, `demo`, `guard`, `guard-after`, `hook`, `reembed`, `dream`, `greeting`, `reflect`, `serve`, `status`, `doctor`, `observe-tool`, `promote`, and `impact`. | CLI subcommands | mcp-server/index.ts; tests/mcp-server.test.js; tests/hooks-config.test.js | Yes, relevant CLI and hook-config cases passed in the targeted 2026-07-10 run |
 | E35 - The REST sidecar defaults to `127.0.0.1`, refuses non-loopback binds without `AUDREY_API_KEY` unless `AUDREY_ALLOW_NO_AUTH=1`, and emits a no-auth warning when that override is used. | Loopback bind discipline | src/server.ts:13-31; mcp-server/index.ts:217-225,1266-1280 | Yes, 2026-05-08 |
 | E36 - Audrey ships a Python client that calls the REST sidecar and exposes synchronous and asynchronous encode, recall, recall-response, and impact operations. | Python client | README.md:127-184; python/audrey_memory/client.py:116-181,258-310 | Yes, 2026-05-08 |
-| E37 - The documented environment matrix includes security-relevant defaults for data directory, agent identity, embedding and LLM provider selection, device, port, host, API key, no-auth override, admin tools, promote roots, debug/profile flags, warmup, ONNX verbosity, SQLite pragmas, and context budget. | README configuration matrix | README.md:220-236 | Yes, 2026-05-08 |
+| E37 - The documented environment matrix includes security-relevant defaults for data directory, agent identity, embedding and LLM provider selection and model override, device, port, host, API key, no-auth override, admin tools, hook memory scope, hook failure policy, debug/profile flags, warmup, ONNX verbosity, SQLite pragmas, and context budget. | README configuration matrix | README.md; .env.example; mcp-server/config.ts | Yes, re-verified 2026-07-10 |
 | E38 - `AUDREY_MODEL` is not a documented Audrey environment variable in the README matrix; embedding model selection is represented by provider defaults in configuration and embedding-provider constructors. | Environment variable scope and provider defaults | README.md:220-236; mcp-server/config.ts:38-79; src/embedding.ts:39-46,122-180,207-218 | Yes, `rg "AUDREY_MODEL" README.md src mcp-server package.json` returned no Audrey runtime variable on 2026-05-08 |
 | E39 - Release and verification scripts include build, typecheck, Vitest, perf benchmark, performance snapshot, memory regression check, GuardBench check, npm pack dry-run, release gate, sandbox release gate, and documented Python unittest/build commands. | Test and release gates | package.json:39-58; README.md:200,247-300,352-356; python/tests/test_client.py:124-149,195-245 | Yes, 2026-05-12 |
 | E40 - Recall checks vector-table availability, records per-type partial failures for missing vector tables or KNN errors, records FTS lookup failures, and attaches collected `RecallError[]` to the returned recall result while preserving available partial results. | Recall partial-failure pathway | src/recall.ts:82-105,626-721,741-753 | Yes, 2026-05-08 |
 | E41 - The Phase 3 demo run rebuilt the project with `npm run build`, which completed successfully before executing the repeated-failure demo. | Build command for evaluation demo | package.json:39-40; Phase 3 command output | Yes, command succeeded on 2026-05-08 |
 | E42 - The Phase 3 repeated-failure demo printed an Audrey Guard `BLOCKED` decision with risk score `0.90`, two blocking memory reflexes, one warning reflex, three evidence IDs, one repeated failure prevented, one helpful memory validation recorded, and three evidence IDs attached. | Demo transcript captured for evaluation | mcp-server/index.ts:828-880; Phase 3 command output | Yes, command succeeded on 2026-05-08 |
-| E43 - Audrey exposes a Claude Code hook generator, guarded settings apply path, and hook-mode Guard command: `hook-config claude-code` emits hooks, `hook-config claude-code --apply --scope project|user` merges them into Claude Code settings with backup/idempotence, `guard --hook --fail-on-warn` consumes PreToolUse JSON and returns `hookSpecificOutput.permissionDecision`, and `observe-tool` records post-tool events. Codex hook wiring remains pending on a stable host hook surface. | Hook integration boundary | README.md; mcp-server/index.ts; tests/mcp-server.test.js | Yes, focused Vitest and CLI hook smoke passed on 2026-05-12 |
-| E44 - Audrey preflight events now persist `preflight_evidence_ids` and `audrey_guard_action_key`; `memory_validate` accepts optional `preflight_event_id`, action key, and evidence ids, persists them on the validation audit event, and rejects validation lineage when the memory id was not evidence for that preflight. | Validation lineage implementation | src/action-key.ts; src/controller.ts; src/preflight.ts; src/audrey.ts; mcp-server/index.ts; tests/controller.test.js | Yes, focused Vitest passed on 2026-05-12 |
+| E43 - Audrey 1.1 ships one normalized lifecycle adapter and host-specific configuration for current Claude Code and Codex CLIs. `audrey install --host auto` registers MCP and applies hooks for detected hosts from stable executable paths. `hook-config` supports preview, scoped apply, private backups, and idempotent Audrey-handler replacement; `uninstall` supports non-mutating preview and removes Audrey-owned registrations and handlers in the selected scope. Session and prompt hooks inject bounded, agent-scoped context; PreToolUse creates Guard receipts; post-tool events correlate outcomes by `session_id + tool_use_id`; sanitized failures may form durable memories; Stop and PostCompact run due-only maintenance. Codex requires explicit non-managed hook trust through `/hooks`. Hook errors fail open unless `AUDREY_HOOK_FAIL_CLOSED=1`. Coverage remains limited to events and tool paths emitted by the host, and each hook starts a short-lived Audrey process rather than using a persistent daemon. | Automatic lifecycle integration and boundary | README.md; CHANGELOG.md; mcp-server/hooks.ts; mcp-server/index.ts; src/autopilot.ts; tests/autopilot.test.js; tests/hooks-config.test.js; tests/mcp-server.test.js | Yes, build plus 191 focused install, hook, Autopilot, preflight, controller, and HTTP tests passed on 2026-07-10 |
+| E44 - Audrey preflight events now persist `preflight_evidence_ids` and `audrey_guard_action_key`; `memory_validate` accepts optional `preflight_event_id`, action key, and evidence ids, persists them on the validation audit event, and rejects validation lineage when the memory id was not evidence for that preflight. Preflight embedding queries are bounded, while exact action identity hashes the full normalized, redacted action so large inputs with a shared prefix do not collide. | Validation lineage implementation | src/action-key.ts; src/controller.ts; src/preflight.ts; src/audrey.ts; mcp-server/index.ts; tests/controller.test.js | Yes, focused Vitest passed on 2026-07-10, including a large-action prefix-collision regression |
 | E45 - Preflight risk scoring uses a fixed severity map (`info=0.1`, `low=0.25`, `medium=0.55`, `high=0.85`), sorts warnings by severity, and strict mode blocks on high-severity warnings; the scoring path does not consume validation feedback. | Fixed risk scoring boundary | src/preflight.ts:6-60,291-299,332-338; src/feedback.ts:3-18,70-163 | Yes, 2026-05-08 |
-| E46 - `benchmarks/guardbench.js` runs ten local comparative GuardBench scenarios across Audrey Guard, no-memory, recent-window, vector-only, and FTS-only adapters and writes `benchmarks/output/guardbench-summary.json`, `benchmarks/output/guardbench-manifest.json`, and `benchmarks/output/guardbench-raw.json`; the latest local run has Audrey Guard passing 10/10 scenarios with 100% prevention rate, 0% false-block rate, 100% evidence recall, zero decision-output redaction leaks, zero published artifact raw-secret leaks, 100% recall-degradation detection, 100% decision accuracy, and 2.916ms/21.17ms p50/p95 guard latency under the mock-provider methodology. Baseline decision accuracy was no-memory 10%, recent-window 60%, vector-only 40%, and FTS-only 10%, with 0% full-contract pass rate for each baseline. | GuardBench local comparative results | benchmarks/guardbench.js; benchmarks/output/guardbench-summary.json; benchmarks/output/guardbench-manifest.json; benchmarks/output/guardbench-raw.json; package.json | Yes, `npm run bench:guard:check` passed on 2026-05-13 |
+| E46 - `benchmarks/guardbench.js` runs ten local comparative GuardBench scenarios across Audrey Guard, no-memory, recent-window, vector-only, and FTS-only adapters and writes `benchmarks/output/guardbench-summary.json`, `benchmarks/output/guardbench-manifest.json`, and `benchmarks/output/guardbench-raw.json`; the latest local run has Audrey Guard passing 10/10 scenarios with 100% prevention rate, 0% false-block rate, 100% evidence recall, zero decision-output redaction leaks, zero published artifact raw-secret leaks, 100% recall-degradation detection, 100% decision accuracy, and 3.501ms/20.658ms p50/p95 guard latency under the mock-provider methodology. Baseline decision accuracy was no-memory 10%, recent-window 60%, vector-only 40%, and FTS-only 10%, with 0% full-contract pass rate for each baseline. | GuardBench local comparative results | benchmarks/guardbench.js; benchmarks/output/guardbench-summary.json; benchmarks/output/guardbench-manifest.json; benchmarks/output/guardbench-raw.json; package.json | Yes, `npm run bench:guard:check` passed on 2026-05-13 |
 | E47 - GuardBench accepts external ESM adapters through `--adapter`, supports `default`, `adapter`, or `createGuardBenchAdapter()` exports, withholds `expectedDecision` and `requiredEvidence` during adapter execution, then scores adapter output against the same full-contract decision/evidence/redaction checks. | GuardBench external adapter contract | benchmarks/guardbench.js; tests/guardbench.test.js; package.json | Yes, `node scripts/run-vitest.mjs run tests/guardbench.test.js` passed on 2026-05-12 |
 | E48 - Audrey ships a Mem0 Platform GuardBench adapter that uses the current Mem0 REST shape: V3 async memory add with event polling, V2 filtered memory search, and user-entity cleanup. It requires runtime `MEM0_API_KEY` and is not run by default. | First external-system GuardBench adapter | benchmarks/adapters/mem0-platform.mjs; tests/guardbench.test.js; README.md | Import/contract and mocked REST-flow tests passed on 2026-05-12; live Mem0 run not yet executed |
 | E49 - GuardBench ships a credential-free example external adapter and a `bench:guard:adapter-smoke` script so the adapter loader can be exercised through the real CLI path without external credentials. | External adapter smoke path | benchmarks/adapters/example-allow.mjs; package.json; README.md; tests/guardbench.test.js | Yes, `npm run bench:guard:adapter-smoke` passed on 2026-05-12 |

package/docs/paper/output/submission-bundle/docs/paper/output/arxiv/arxiv-manifest.json

@@ -1,11 +1,11 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "Audrey arXiv source package",
-  "generatedAt": "2026-05-29T03:45:42.097Z",
+  "generatedAt": "2026-07-10T15:00:47.587Z",
   "sourceMarkdown": "docs/paper/audrey-paper-v1.md",
   "publicationPack": "docs/paper/publication-pack.json",
   "sourceHashes": {
-    "sourceMarkdown": "f2afc1cda24b1ba91cf39429e7836ead97c7a1c815b294b3d623bb20d8f5e7e6",
+    "sourceMarkdown": "d8eca75076e4ce06b1d6f15a5f2c91b2fab6da767c0bd613539b6fb9dace802d",
     "publicationPack": "a1a523d5938faea72be568b843ac3890e61cea6070b0cfa46acf22ad3d2fb974",
     "referencesBib": "c0bfcaf7bfe37d6933c812e46352be8a95397eaa430a0f5bc94037600a53f654"
   },
@@ -13,8 +13,8 @@
     {
       "path": "main.tex",
       "source": "docs/paper/audrey-paper-v1.md",
-      "bytes": 122667,
-      "sha256": "e3ee98ea8c523e8f394b8fbbc73e206f0d6126b7349df5669206d4d48d9feea6"
+      "bytes": 124811,
+      "sha256": "1dbe78fa0648e70bd02db6ff29352d8af859af25e27eb28e39a3cd78fa0965f9"
     },
     {
       "path": "references.bib",

package/docs/paper/output/submission-bundle/docs/paper/output/arxiv/main.tex

@@ -673,11 +673,13 @@ The JSON walker redacts sensitive keys and values recursively. If a value sits u
 
 \subsection{MCP, CLI, and REST Surfaces}
 
-The MCP server registers 20 tools: \texttt{memory\_dream}, \texttt{memory\_encode}, \texttt{memory\_recall}, \texttt{memory\_consolidate}, \texttt{memory\_introspect}, \texttt{memory\_resolve\_truth}, \texttt{memory\_export}, \texttt{memory\_import}, \texttt{memory\_forget}, \texttt{memory\_validate}, \texttt{memory\_decay}, \texttt{memory\_status}, \texttt{memory\_reflect}, \texttt{memory\_greeting}, \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_reflexes}, and \texttt{memory\_promote} (Ledger: E32). The Guard-relevant MCP surface is \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, and \texttt{memory\_reflexes}, with \texttt{memory\_validate} supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
+The MCP server registers 22 tools: \texttt{memory\_dream}, \texttt{memory\_encode}, \texttt{memory\_recall}, \texttt{memory\_consolidate}, \texttt{memory\_introspect}, \texttt{memory\_resolve\_truth}, \texttt{memory\_export}, \texttt{memory\_import}, \texttt{memory\_forget}, \texttt{memory\_validate}, \texttt{memory\_decay}, \texttt{memory\_status}, \texttt{memory\_reflect}, \texttt{memory\_greeting}, \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_guard\_before}, \texttt{memory\_guard\_after}, \texttt{memory\_reflexes}, and \texttt{memory\_promote} (Ledger: E32). The Guard-relevant MCP surface is \texttt{memory\_observe\_tool}, \texttt{memory\_recent\_failures}, \texttt{memory\_capsule}, \texttt{memory\_preflight}, \texttt{memory\_guard\_before}, \texttt{memory\_guard\_after}, and \texttt{memory\_reflexes}, with \texttt{memory\_validate} supporting closed-loop validation and REST or CLI impact reporting supporting aggregate impact inspection (Ledger: E16-E19, E32-E34).
 
-The CLI recognizes \texttt{install}, \texttt{uninstall}, \texttt{mcp-config}, \texttt{hook-config}, \texttt{demo}, \texttt{guard}, \texttt{reembed}, \texttt{dream}, \texttt{greeting}, \texttt{reflect}, \texttt{serve}, \texttt{status}, \texttt{doctor}, \texttt{observe-tool}, \texttt{promote}, and \texttt{impact} (Ledger: E34). The \texttt{guard} subcommand invokes the controller, prints JSON or formatted output, exits nonzero for blocking decisions unless an explicit override is supplied, and can run as a Claude Code PreToolUse hook with \texttt{--hook}. \texttt{hook-config claude-code --apply} merges the generated hook block into Claude Code settings with backup/idempotence (Ledger: E26, E43).
+The CLI recognizes \texttt{install}, \texttt{uninstall}, \texttt{mcp-config}, \texttt{hook-config}, \texttt{demo}, \texttt{guard}, \texttt{guard-after}, \texttt{hook}, \texttt{reembed}, \texttt{dream}, \texttt{greeting}, \texttt{reflect}, \texttt{serve}, \texttt{status}, \texttt{doctor}, \texttt{observe-tool}, \texttt{promote}, and \texttt{impact} (Ledger: E34). The \texttt{guard} subcommand remains available for explicit checks, while the host-facing \texttt{hook} subcommand normalizes current Claude Code and Codex lifecycle payloads. \texttt{audrey install --host auto} discovers installed supported CLIs, registers the MCP server, and applies host-specific lifecycle hooks from a stable Node and Audrey entrypoint. Generated settings preserve unrelated hooks, replace older Audrey-owned handlers, write backups before changing non-empty files, and are idempotent. Claude Code supports local, project, and user hook scopes; Codex supports project and user scopes and requires one-time review of non-managed hooks through \texttt{/hooks} (Ledger: E26, E43).
 
-The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without \texttt{AUDREY\_API\_KEY} unless \texttt{AUDREY\_ALLOW\_NO\_AUTH=1}, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless \texttt{AUDREY\_ENABLE\_ADMIN\_TOOLS=1} (Ledger: E33).
+The generated lifecycle covers session start, user prompt submission, guarded pre-tool use, correlated post-tool outcomes, post-compaction, and turn stop. Session and prompt hooks inject bounded, agent-scoped memory context. Pre-tool hooks create Guard receipts, and post-tool hooks close the matching receipt by \texttt{session\_id + tool\_use\_id}; sanitized failures may become durable memories. Claude Code exposes an explicit failure event. Current Codex Bash hooks can omit exit status, so Audrey records an opaque result as \texttt{unknown} unless structured fields or response text establish success or failure. Stop and post-compaction hooks run consolidation only when due. Audrey fails open on hook-runtime errors by default, with explicit fail-closed operation available through \texttt{AUDREY\_HOOK\_FAIL\_CLOSED=1}. This is lifecycle integration, not a complete enforcement boundary: Audrey can inspect only the events and tool paths emitted by each host, and the short-lived hook process still pays provider startup cost instead of using a persistent daemon (Ledger: E43).
+
+The REST sidecar exposes routes for health, encode, recall, validate, mark-used, capsule, preflight, Guard before/after receipts, reflexes, consolidate, dream, introspect, impact, resolve-truth, export, import, forget, decay, status, reflect, and greeting (Ledger: E33). The sidecar defaults to loopback binding, refuses non-loopback binds without \texttt{AUDREY\_API\_KEY} unless \texttt{AUDREY\_ALLOW\_NO\_AUTH=1}, and emits an explicit warning when that no-auth override is used (Ledger: E35). Export, import, and forget are disabled unless \texttt{AUDREY\_ENABLE\_ADMIN\_TOOLS=1} (Ledger: E33).
 
 \subsection{Configuration}
 
@@ -729,13 +731,13 @@ These numbers measure Audrey's local call path under an in-process mock embeddin
 
 \subsection{Behavioral Regression Result}
 
-The current \texttt{benchmarks/output/summary.json} was generated on 2026-05-29T03:45:32.997Z with command \texttt{node benchmarks/run.js --provider mock --dimensions 64} (Ledger: E24). It reports:
+The current \texttt{benchmarks/output/summary.json} was generated on 2026-07-10T15:00:37.705Z with command \texttt{node benchmarks/run.js --provider mock --dimensions 64} (Ledger: E24). It reports:
 
 \begin{verbatim}
 | System | Score Percent | Pass Rate | Average Duration Ms |
-| Audrey | 100 | 100 | 15.416666666666666 |
-| Vector Only | 41.66666666666667 | 25 | 0.3333333333333333 |
-| Keyword + Recency | 41.66666666666667 | 25 | 0.6666666666666666 |
+| Audrey | 100 | 100 | 16.25 |
+| Vector Only | 41.66666666666667 | 25 | 0.25 |
+| Keyword + Recency | 41.66666666666667 | 25 | 0.5833333333333334 |
 | Recent Window | 37.5 | 25 | 0 |
 \end{verbatim}
 
@@ -759,7 +761,7 @@ It reports local adapters only, not external-system comparisons (Ledger: E46):
 | Evidence recall | 100% |
 | Redaction leaks | 0 |
 | Recall-degradation detection | 100% |
-| Guard latency p50 / p95 | 2.916 ms / 21.17 ms |
+| Guard latency p50 / p95 | 3.501 ms / 20.658 ms |
 | Published artifact raw-secret leaks | 0 |
 | Audrey Guard decision accuracy | 100% |
 | No-memory decision accuracy | 10% |
@@ -908,7 +910,7 @@ Reflex generation is deterministic, not adaptive. Reflexes are mapped from prefl
 
 \subsection{Open Problems}
 
-Host hook parity. Audrey exposes CLI pieces that host hooks can call, and Claude Code documents hook extension points \cite{anthropic2026claudecodehooks}. Audrey now generates and applies Claude Code hook settings, \texttt{guard --hook} emits the current PreToolUse \texttt{hookSpecificOutput.permissionDecision} shape, and \texttt{observe-tool} records post-tool events (Ledger: E43). The remaining production installer work is equivalent wiring for hosts with stable hook surfaces, especially Codex.
+Host hook coverage and process model. Audrey 1.1 generates, applies, and removes lifecycle hooks for current Claude Code and Codex CLIs; the shared adapter injects bounded context, runs Guard before selected side-effectful tools, correlates post-tool outcomes, and performs due-only maintenance (Ledger: E43). This closes the configuration gap, not the enforcement gap. Hook execution still depends on host trust and on the host emitting a supported event for the relevant tool path. Alternate or incompletely intercepted host tool paths remain outside Audrey's view. Each hook also starts a short-lived Audrey process, so the default local embedding provider can pay cold-start cost repeatedly. Production follow-up is a persistent local runtime, measured compatibility gates against supported host versions, and organization-managed deployment that binds tenant identity and enforcement policy outside a caller-controlled routing header. Claude Code's documented hook surface remains an example of the underlying host boundary \cite{anthropic2026claudecodehooks}.
 
 Validation lineage is implemented but not yet policy-adaptive. Audrey can bind validation events to the exact preflight event, evidence IDs, and action key that produced a decision, and rejects mismatched evidence claims (Ledger: E44). The next step is using that closed-loop signal to tune warning priority and recommendation wording without giving the model direct control over policy.
 

package/docs/paper/output/submission-bundle/docs/paper/output/arxiv-compile-report.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "Audrey arXiv compile check",
-  "generatedAt": "2026-05-29T03:45:42.412Z",
+  "generatedAt": "2026-07-10T15:00:49.374Z",
   "source": {
     "sourceDir": "docs/paper/output/arxiv",
     "manifest": "docs/paper/output/arxiv/arxiv-manifest.json",
-    "manifestSha256": "6364c368755a4188d5b2deea9e3fe80201f5fa55658e6ae570141e54c5293bc6",
+    "manifestSha256": "9df7fee92964064551d7eb23098800f909f7ae8dc770be2ddcc29ff3cb33723a",
     "mainTex": "docs/paper/output/arxiv/main.tex",
-    "mainTexSha256": "e3ee98ea8c523e8f394b8fbbc73e206f0d6126b7349df5669206d4d48d9feea6",
+    "mainTexSha256": "1dbe78fa0648e70bd02db6ff29352d8af859af25e27eb28e39a3cd78fa0965f9",
     "referencesBib": "docs/paper/output/arxiv/references.bib",
     "referencesBibSha256": "c0bfcaf7bfe37d6933c812e46352be8a95397eaa430a0f5bc94037600a53f654"
   },

package/docs/paper/output/submission-bundle/package.json

@@ -1,7 +1,7 @@
 {
   "name": "audrey",
-  "version": "1.0.2",
-  "description": "Local-first memory runtime for AI agents with recall, consolidation, memory reflexes, contradiction detection, and tool-trace learning",
+  "version": "1.1.0",
+  "description": "Automatic, evidence-backed memory and pre-action Guard for Codex, Claude Code, and custom AI agents",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -176,6 +176,9 @@
     "local-first-memory",
     "rag",
     "claude",
+    "claude-code",
+    "codex",
+    "agent-memory-autopilot",
     "agent-framework",
     "rest-api",
     "http-server"

package/docs/paper/output/submission-bundle/paper-submission-manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "Audrey paper submission bundle",
-  "generatedAt": "2026-05-29T03:45:42.799Z",
+  "generatedAt": "2026-07-10T15:00:49.652Z",
   "sourceRoot": ".",
   "outDir": "docs/paper/output/submission-bundle",
   "claimVerification": {
@@ -17,33 +17,33 @@
     "scenarios": 10,
     "redactionLeaks": 0,
     "artifactLeaks": 0,
-    "latencyP50Ms": 2.916,
-    "latencyP95Ms": 21.17
+    "latencyP50Ms": 3.501,
+    "latencyP95Ms": 20.658
   },
   "files": [
     {
       "path": "benchmarks/output/adapter-self-test/guardbench-adapter-self-test.json",
       "source": "benchmarks/output/adapter-self-test/guardbench-adapter-self-test.json",
       "bytes": 1266,
-      "sha256": "5e17a9311141e22d1df5e86a802c29981d9bd6427de3ed3af00bee3d75f2011c"
+      "sha256": "cec260495a24c16d95d34a327100b29c0247a67ef4d575bfb9a8d64e438b1cc4"
     },
     {
       "path": "benchmarks/output/external/guardbench-external-dry-run.json",
       "source": "benchmarks/output/external/guardbench-external-dry-run.json",
       "bytes": 1831,
-      "sha256": "32eaacbacf59ad6046e442bae6ab72920806f8607a1439170203ef46b6f18d7c"
+      "sha256": "5660f3ebcddb2edc196f800885de302749f48f21952dc4e8ab6363a24a33a9f4"
     },
     {
       "path": "benchmarks/output/external/guardbench-external-evidence.json",
       "source": "benchmarks/output/external/guardbench-external-evidence.json",
       "bytes": 1638,
-      "sha256": "617e4f00748b5c563a9c0a146b91712369854b6b00d4a72fe0375a37260966e8"
+      "sha256": "23b47bc6d66f3d2e892853fdeef43d179b6aaf8695520cbbf9cbde2bc8926500"
     },
     {
       "path": "benchmarks/output/guardbench-conformance-card.json",
       "source": "benchmarks/output/guardbench-conformance-card.json",
-      "bytes": 1733,
-      "sha256": "a32ce0a46b2f031e827caa0896fdd6a870acf92f6bccb481ca661a3ea4b74a79"
+      "bytes": 1735,
+      "sha256": "f7e755fdc52216dbe387f28b3acdd6068b51b908db0cabde455b6d793b62ed43"
     },
     {
       "path": "benchmarks/output/guardbench-manifest.json",
@@ -54,44 +54,44 @@
     {
       "path": "benchmarks/output/guardbench-raw.json",
       "source": "benchmarks/output/guardbench-raw.json",
-      "bytes": 43407,
-      "sha256": "15b39fd1a65709a89455fbfcaf815daf364b204fa526d5065cc12fcaed281d28"
+      "bytes": 43454,
+      "sha256": "1888c8524d54f10bb403ef09b923cec63376518bf6d202ef271ba895811d37d8"
     },
     {
       "path": "benchmarks/output/guardbench-summary.json",
       "source": "benchmarks/output/guardbench-summary.json",
-      "bytes": 69260,
-      "sha256": "e8669cd6c80dc3dc849b3c4fcc473ea706eb3a760bced69682d0dc2396b2e233"
+      "bytes": 69347,
+      "sha256": "88cd54e091e5aa89e7ef873a2e440430b3c35eb3f4664d963a56d197cc3691e9"
     },
     {
       "path": "benchmarks/output/leaderboard/guardbench-leaderboard.json",
       "source": "benchmarks/output/leaderboard/guardbench-leaderboard.json",
-      "bytes": 2796,
-      "sha256": "4468365e70f156f01e202721644f5e6d273b8482bc740e15b484484acde33ef9"
+      "bytes": 2798,
+      "sha256": "28f0bdac7ab72cf2a1a217663580fbc0735754ab975b1bb015529ea5b264760e"
     },
     {
       "path": "benchmarks/output/leaderboard/guardbench-leaderboard.md",
       "source": "benchmarks/output/leaderboard/guardbench-leaderboard.md",
-      "bytes": 363,
-      "sha256": "e492fd96572fa8b2464357aad7b3f3c7e321ad42a11a18b9a343b23b349fc4be"
+      "bytes": 364,
+      "sha256": "5f108590c11c9d1904ea6339a7da63b311bf9bdd82ec078fa0f795530eff9386"
     },
     {
       "path": "benchmarks/output/submission-bundle/submission-manifest.json",
       "source": "benchmarks/output/submission-bundle/submission-manifest.json",
-      "bytes": 3984,
-      "sha256": "cc43138aef6db9998079d5b7b638861af497f43e737f731f52fc0fd4abd00da8"
+      "bytes": 3986,
+      "sha256": "9a038de29a775fc5e870bab0575c96fce21a22eed6992acefb9404b61b3426e4"
     },
     {
       "path": "benchmarks/output/submission-bundle/validation-report.json",
       "source": "benchmarks/output/submission-bundle/validation-report.json",
       "bytes": 739,
-      "sha256": "6f6c385d8db108b1a5e30de389a1131bece70ccb18c552a5f005f7dbe377d695"
+      "sha256": "9db6530947c3f88de484235f44eaa47e7aca98dee8d3603ea0daf067d28a98d3"
     },
     {
       "path": "benchmarks/output/summary.json",
       "source": "benchmarks/output/summary.json",
-      "bytes": 100748,
-      "sha256": "8ad41efec05b0f099a818e64fd191707be5bf6317d41fc353869df10c18918c7"
+      "bytes": 100724,
+      "sha256": "6683760a6b72a2562aa3d8ee35492db7bf599aa4ed089676fb69a6fad5124b3d"
     },
     {
       "path": "benchmarks/schemas/guardbench-adapter-registry.schema.json",
@@ -168,8 +168,8 @@
     {
       "path": "docs/AUDREY_PAPER_OUTLINE.md",
       "source": "docs/AUDREY_PAPER_OUTLINE.md",
-      "bytes": 9329,
-      "sha256": "a728e690ccfcba6c7854bb4589123fb8714f17c9b2a7ae1109aa5ad6f7e75b81"
+      "bytes": 9555,
+      "sha256": "68662927f742f9f9947b30a4885e1fa166f78daa5ccb4a811e4e8df5834976f7"
     },
     {
       "path": "docs/paper/00-master.md",
@@ -210,20 +210,20 @@
     {
       "path": "docs/paper/06-implementation.md",
       "source": "docs/paper/06-implementation.md",
-      "bytes": 14471,
-      "sha256": "497fa20661f152da603ec0801f56e06ec81817487e4c2079775669368dd80ba3"
+      "bytes": 16223,
+      "sha256": "f1f2bedbc3766246201121c51e0319820acb51af2a61715383c630dad716ce56"
     },
     {
       "path": "docs/paper/07-evaluation.md",
       "source": "docs/paper/07-evaluation.md",
-      "bytes": 11268,
-      "sha256": "4e712ef36a936df5034c67aff5c0167013aeb0b843067b6499ab7f47c2cb39e7"
+      "bytes": 11242,
+      "sha256": "cbe7d6823de7d9d2f16da1b7915ae0f9043dd0cde14913164941ef0e555610f7"
     },
     {
       "path": "docs/paper/08-discussion-limitations.md",
       "source": "docs/paper/08-discussion-limitations.md",
-      "bytes": 9010,
-      "sha256": "71645e65e2621029b2added1302f34e89332e223a6b162ead86c278230c1f8d1"
+      "bytes": 9595,
+      "sha256": "ef6b836ba450e18aa6c0eb0b1793183f7c1b7661a9ccbd9ba076409f73de8cbd"
     },
     {
       "path": "docs/paper/09-conclusion.md",
@@ -252,8 +252,8 @@
     {
       "path": "docs/paper/audrey-paper-v1.md",
       "source": "docs/paper/audrey-paper-v1.md",
-      "bytes": 116616,
-      "sha256": "f2afc1cda24b1ba91cf39429e7836ead97c7a1c815b294b3d623bb20d8f5e7e6"
+      "bytes": 118697,
+      "sha256": "d8eca75076e4ce06b1d6f15a5f2c91b2fab6da767c0bd613539b6fb9dace802d"
     },
     {
       "path": "docs/paper/browser-launch-plan.json",
@@ -294,26 +294,26 @@
     {
       "path": "docs/paper/evidence-ledger.md",
       "source": "docs/paper/evidence-ledger.md",
-      "bytes": 61843,
-      "sha256": "3dbf5d3b80937b468da063df7b884ba2d8a0d1e52d2c0d27a3a60f287cfdd9a2"
+      "bytes": 63088,
+      "sha256": "ae1266e442a5211200b2b3c71396794645a43d0e9893aa285b26a91c9b5d7890"
     },
     {
       "path": "docs/paper/output/arxiv-compile-report.json",
       "source": "docs/paper/output/arxiv-compile-report.json",
       "bytes": 924,
-      "sha256": "245aef38f5f4edca073731ed0c35560a7a3f67b0be52571e0bee172d155d7b99"
+      "sha256": "ebf699f79454b8237e04f6973dc00035a7385054b23fdda9ba3f528d16197ae8"
     },
     {
       "path": "docs/paper/output/arxiv/arxiv-manifest.json",
       "source": "docs/paper/output/arxiv/arxiv-manifest.json",
       "bytes": 1316,
-      "sha256": "6364c368755a4188d5b2deea9e3fe80201f5fa55658e6ae570141e54c5293bc6"
+      "sha256": "9df7fee92964064551d7eb23098800f909f7ae8dc770be2ddcc29ff3cb33723a"
     },
     {
       "path": "docs/paper/output/arxiv/main.tex",
       "source": "docs/paper/output/arxiv/main.tex",
-      "bytes": 122667,
-      "sha256": "e3ee98ea8c523e8f394b8fbbc73e206f0d6126b7349df5669206d4d48d9feea6"
+      "bytes": 124811,
+      "sha256": "1dbe78fa0648e70bd02db6ff29352d8af859af25e27eb28e39a3cd78fa0965f9"
     },
     {
       "path": "docs/paper/output/arxiv/README-arxiv.txt",
@@ -366,14 +366,14 @@
     {
       "path": "package.json",
       "source": "package.json",
-      "bytes": 12529,
-      "sha256": "08eed72a235182d32ee495c7fea7f98d5641d855ef387f36f8a57adfbd10eb4e"
+      "bytes": 12556,
+      "sha256": "769edc3fca3b2cb559222b74def8c71d3b489368d9552d753ea188d4daef6123"
     },
     {
       "path": "README.md",
       "source": "README.md",
-      "bytes": 26368,
-      "sha256": "4a0c524c65557c042f1752d29c668dfa3656fba6c53be335e50adefc8e9d3597"
+      "bytes": 21876,
+      "sha256": "ef1479943d891b6c7e3a77424790a6c79acf8e2ed1833cd7da4761ea454abedd"
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "audrey",
-  "version": "1.0.2",
-  "description": "Local-first memory runtime for AI agents with recall, consolidation, memory reflexes, contradiction detection, and tool-trace learning",
+  "version": "1.1.0",
+  "description": "Automatic, evidence-backed memory and pre-action Guard for Codex, Claude Code, and custom AI agents",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -176,6 +176,9 @@
     "local-first-memory",
     "rag",
     "claude",
+    "claude-code",
+    "codex",
+    "agent-memory-autopilot",
     "agent-framework",
     "rest-api",
     "http-server"

package/scripts/audit-release-completion.mjs

@@ -10,7 +10,7 @@ import { verifyBrowserLaunchResults } from './verify-browser-launch-results.mjs'
 import { verifyReleaseReadiness } from './verify-release-readiness.mjs';
 
 const ROOT = process.cwd();
-const DEFAULT_VERSION = '1.0.0';
+const DEFAULT_VERSION = '1.1.0';
 const DEFAULT_OUT = '.tmp/release-artifacts/completion-audit.json';
 const NPM_REGISTRY = 'https://registry.npmjs.org/';
 
@@ -214,7 +214,7 @@ export async function auditReleaseCompletion(options = {}) {
   checklist.push(
     checklistItem(
       'code-release-local-readiness',
-      'Audrey codebase is cut to 1.0.0 and local release gates are coherent.',
+      `Audrey codebase is cut to ${version} and local release gates are coherent.`,
       statusFromGaps(versionGaps, readiness.ok),
       [
         `package.json version=${pkg.version}`,
@@ -241,7 +241,7 @@ export async function auditReleaseCompletion(options = {}) {
   checklist.push(
     checklistItem(
       'source-control-release-state',
-      'Final release commit and v1.0.0 tag are present on the public repository.',
+      `Final release commit and v${version} tag are present on the public repository.`,
       statusFromGaps(sourceGaps, bundleVerify.ok && remoteRefsResult.ok),
       [
         commandEvidence(bundleVerify),
@@ -262,7 +262,7 @@ export async function auditReleaseCompletion(options = {}) {
   checklist.push(
     checklistItem(
       'npm-package-publication',
-      'audrey@1.0.0 npm package is packaged and published.',
+      `audrey@${version} npm package is packaged and published.`,
       statusFromGaps(npmGaps),
       [JSON.stringify(npmArtifact), commandEvidence(npmView)],
       npmGaps,
@@ -279,7 +279,7 @@ export async function auditReleaseCompletion(options = {}) {
   checklist.push(
     checklistItem(
       'python-package-publication',
-      'audrey-memory 1.0.0 Python package is built and published.',
+      `audrey-memory ${version} Python package is built and published.`,
       statusFromGaps(pypiGaps),
       [JSON.stringify(wheel), JSON.stringify(sdist), `PyPI status=${pypi.status}`],
       pypiGaps,
@@ -373,10 +373,10 @@ export async function auditReleaseCompletion(options = {}) {
     schemaVersion: '1.0.0',
     suite: 'Audrey release completion audit',
     generatedAt: new Date().toISOString(),
-    objective: 'audrey 1.0 release + published audrey research paper',
+    objective: `audrey ${version} release + published audrey research paper`,
     successCriteria: [
-      'Audrey code is cut to 1.0.0 with local gates passing.',
-      'Final release commit and v1.0.0 tag are on the public repository.',
+      `Audrey code is cut to ${version} with local gates passing.`,
+      `Final release commit and v${version} tag are on the public repository.`,
       'npm and Python packages are packaged and publicly published.',
       'Paper artifacts verify locally and compile for arXiv.',
       'Paper publication targets are publicly submitted and operator verified.',

package/scripts/finalize-release.mjs

@@ -7,7 +7,7 @@ import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
-const DEFAULT_VERSION = '1.0.0';
+const DEFAULT_VERSION = '1.1.0';
 const DEFAULT_ARTIFACT_DIR = '.tmp/release-artifacts';
 const NPM_REGISTRY = 'https://registry.npmjs.org/';
 const RELEASE_COMMANDS = new Set(['git', 'node', 'npm', 'python']);

package/scripts/prepare-release-cut.mjs

@@ -3,7 +3,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = process.cwd();
-const DEFAULT_TARGET_VERSION = '1.0.0';
+const DEFAULT_TARGET_VERSION = '1.1.0';
 const VERSION_RE =
   /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;