audrey 1.1.1 → 1.1.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.1.2 - 2026-07-13
+
+### Guard signal quality
+
+- Consolidation now sweeps every real owning agent instead of the CLI utility agent, so `audrey dream` and reflection actually convert episodes into semantic and procedural knowledge on stores that previously reported "evaluated 0 episodes".
+- Failure streaks are self-extinguishing: `failure_count` counts failures since the tool's last success in scope, and a subsequent success retires the warning instead of letting it nag at high confidence for the full window. Same-instant ties order by monotonic event id and fail toward warning. `include_resolved` preserves the raw diagnostic view.
+- Tool-failure signals are project-scoped: `memory_recent_failures`, `memory_capsule`, and preflight accept a `cwd` and exclude failures recorded in other projects. Directionality is asymmetric on purpose — failures without a recorded directory stay visible because they cannot be proven foreign, while only a success provably from the current project can extinguish a local streak. Autopilot passes the working directory even under shared scope, so cross-project semantic knowledge still travels while foreign failure noise does not.
+- Autopilot-learned tool-failure episodes (tool-result source) now categorize as risks, are tool-matched at medium severity in preflight, and cap their error summaries in capsules at 240 characters. User-authored memories that carry the same tag keep full high-severity risk treatment.
+- Redaction no longer destroys machine identifiers such as MCP tool names: consistently-cased word identifiers (three or more separator-delimited all-lowercase or all-uppercase segments) are exempt from the high-entropy secret rule. Title-cased memorable passphrases and digit-bearing tokens still redact.
+
+### Injection efficiency
+
+- Compact packet format (default; `AUDREY_PACKET_FORMAT=verbose` reverts): entries render as `[memory_id confidence] "content"` lines with a one-line safety preamble. Content stays JSON-quoted; injection-safety invariants are unchanged.
+- Session-delta injection (default; `AUDREY_PACKET_DELTA=0` reverts): each memory is injected once per session instead of on every prompt. SessionStart delivers the full packet and seeds the tracker; the tracker clears on session start and compaction — the moments earlier packets can leave the context window. A memory whose state changes after injection (for example, becoming disputed) reinjects with its new standing. Measured on a production store this removed a repeated 3.5k-character packet from every prompt after the first.
+
+### MCP Registry
+
+- Publishes Audrey to the official MCP Registry as `io.github.evilander/audrey` via GitHub OIDC in the release pipeline, after the npm publish gates pass.
+
 ## 1.1.1 - 2026-07-10
 
 ### npm 12 install compatibility

package/README.md

@@ -347,6 +347,8 @@ The server also sends host instructions explaining the Guard receipt loop when l
 | `AUDREY_DEVICE` | `gpu` | Local embedding device; falls back to CPU |
 | `AUDREY_CONTEXT_BUDGET_CHARS` | `4000` | Maximum default capsule size |
 | `AUDREY_AUTOPILOT_SCOPE` | `agent` | `agent` or explicit cross-agent `shared` recall for hooks |
+| `AUDREY_PACKET_FORMAT` | `compact` | Injected packet style: `compact` line format or `verbose` key=value |
+| `AUDREY_PACKET_DELTA` | `1` | Inject each memory once per session; `0` resends full packets every prompt |
 | `AUDREY_HOOK_FAIL_CLOSED` | `0` | Deny guarded actions when Audrey itself fails |
 | `AUDREY_API_KEY` | unset | Bearer token for REST access |
 | `AUDREY_HOST` | `127.0.0.1` | REST bind address |
@@ -388,7 +390,7 @@ npm run pack:check
 GuardBench currently contains ten local, deterministic pre-action scenarios covering repeated failures, procedures, scope changes, recovery, redaction, conflicting instructions, and noisy stores. The checked-in v1 methodology uses a mock 64-dimensional embedding provider and exists to catch regressions. A perfect local pass is not a claim about real-provider latency or production false-positive rates.
 
 <!-- guardbench-summary:start -->
-Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 3.075ms / 17.056ms p50/p95 Guard latency under the mock-provider methodology.
+Latest local result in this checkout: 10/10 scenarios passed, 100% prevention rate, 0% false-block rate, 0 raw secret leaks, 0 published artifact leaks, and 4.253ms / 21.196ms p50/p95 Guard latency under the mock-provider methodology.
 <!-- guardbench-summary:end -->
 
 `benchmarks/perf-snapshot.js` measures encode and hybrid-recall p50/p95/p99 at configurable corpus sizes with machine and provider provenance. Run it on the hardware and embedding provider you plan to operate; hosted-provider latency is dominated by its network round trip.

package/benchmarks/output/adapter-self-test/guardbench-adapter-self-test.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench adapter self-test",
-  "generatedAt": "2026-07-10T15:19:16.097Z",
+  "generatedAt": "2026-07-13T14:48:54.144Z",
   "ok": true,
   "adapter": {
     "name": "Example Allow Adapter",
@@ -27,9 +27,9 @@
     "evidenceRecall": 0.1,
     "redactionLeaks": 0,
     "latency": {
-      "p50Ms": 0.015,
-      "p95Ms": 0.036,
-      "maxMs": 0.036
+      "p50Ms": 0.011,
+      "p95Ms": 0.041,
+      "maxMs": 0.041
     }
   },
   "contract": {

package/benchmarks/output/external/guardbench-external-dry-run.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench external adapter dry-run matrix",
-  "generatedAt": "2026-07-10T15:19:16.549Z",
+  "generatedAt": "2026-07-13T14:48:54.712Z",
   "ok": true,
   "registry": "benchmarks/adapters/registry.json",
   "outRoot": "benchmarks/output/external",

package/benchmarks/output/external/guardbench-external-evidence.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench external evidence verification",
-  "generatedAt": "2026-07-10T15:19:16.769Z",
+  "generatedAt": "2026-07-13T14:48:54.992Z",
   "ok": true,
   "allowPending": true,
   "registry": "benchmarks/adapters/registry.json",

package/benchmarks/output/guardbench-conformance-card.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "1.0.0",
   "suite": "GuardBench conformance card",
-  "generatedAt": "2026-07-10T15:18:56.703Z",
+  "generatedAt": "2026-07-13T14:48:49.667Z",
   "sourceDir": "benchmarks/output",
   "manifestVersion": "0.2.0",
   "suiteId": "guardbench-local-comparative",
@@ -25,9 +25,9 @@
     "evidenceRecall": 1,
     "redactionLeaks": 0,
     "latency": {
-      "p50Ms": 3.075,
-      "p95Ms": 17.056,
-      "maxMs": 17.056
+      "p50Ms": 4.253,
+      "p95Ms": 21.196,
+      "maxMs": 21.196
     }
   },
   "conformance": {
@@ -39,21 +39,21 @@
   "integrity": {
     "artifactHashes": {
       "guardbench-manifest.json": "57636ce19fdaa6e50fc3fc961d9e499a9f43632f588c713a9fefe8e8a6fa724c",
-      "guardbench-summary.json": "420c3d8188cdc636459ad034d6e5ee3836bdf9e649aa3febe5ce087d681a98bb",
-      "guardbench-raw.json": "46026c7bd5add25bf7aed89357b958b012bcd46549dc7dd6d31362cef0a0e00f"
+      "guardbench-summary.json": "3ba1c059558aa8b511ae510276078930649ba6aca9669324148726fac10c7ee8",
+      "guardbench-raw.json": "786b03ff8570444620c23b35621bbb14897f06310de7e8bd3a337a1acf5ce776"
     },
     "externalRunMetadataHash": null
   },
   "provenance": {
-    "generatedAt": "2026-07-10T15:18:56.391Z",
-    "gitSha": "27632f13e6231ed526303640247343bb60af86a9",
+    "generatedAt": "2026-07-13T14:48:49.313Z",
+    "gitSha": "7111c630be69d3ab96439018f094dc4fac826aca",
     "gitDirty": false,
     "node": "v24.18.0",
     "v8": "13.6.233.17-node.50",
     "platform": "linux",
     "arch": "x64",
     "osRelease": "6.17.0-1018-azure",
-    "cpuModel": "INTEL(R) XEON(R) PLATINUM 8573C",
+    "cpuModel": "AMD EPYC 9V74 80-Core Processor",
     "cpuCount": 4,
     "totalMemoryGb": 15.61,
     "embeddingProvider": "mock",