dsh-mnemon 0.2.16 → 0.3.0

package/README.md

@@ -3,7 +3,7 @@
 <p align="center"><strong>English</strong> · <a href="./README.zh-CN.md">简体中文</a></p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/release-v0.2.16-5b5bd6" alt="release v0.2.16">
+  <img src="https://img.shields.io/badge/release-v0.3.0-5b5bd6" alt="release v0.3.0">
   <img src="https://img.shields.io/badge/memory-3%20tiers-087c5b" alt="three memory tiers">
   <img src="https://img.shields.io/badge/providers-9-c66a09" alt="nine providers">
   <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-43853d" alt="Node.js 20 or newer">
@@ -22,7 +22,7 @@
 <p align="center">
   <a href="./docs/en/capabilities.md"><strong>Explore the capability map</strong></a> ·
   <a href="./docs/en/getting-started.md">Start in five minutes</a> ·
-  <a href="./docs/en/releases/v0.2.16.md">Read the v0.2.16 notes</a> ·
+  <a href="./docs/en/releases/v0.3.0.md">Read the v0.3.0 notes</a> ·
   <a href="https://github.com/omdsh-dev/dsh-mnemon/blob/e6ca446e45bdd17991f3c7c98560456de465282b/docs/assets/media/dsh-mnemon-memory-system-demo.mp4">Watch the widescreen demo</a>
 </p>
 
@@ -30,6 +30,8 @@
 
 [Mnemon](https://github.com/mnemon-dev/mnemon) remains the official, prioritized native engine. The third tier is replaceable; the first two keep the same storage, workspace, and interaction model regardless of provider.
 
+Since v0.3.0, the three tiers are the **default topology** of a composable kernel rather than the only shape hard-coded into every entry point. `MemoryBoot` wires trusted Layer, Adapter, Strategy, Guard, and `MemorySource` contributions into one runtime generation. Each user turn pins a lightweight `TurnView`: exact Runtime context enters Wake eagerly, while Documents and Memory Spaces contribute only bounded routing covers and keep complete recall authority Host-side. Users still install one `dsh-mnemon` package and keep the existing settings, tools, RPC, and UI workflow. See the [composable architecture](./docs/en/architecture.md#composable-memory-kernel) and [extension guide](./docs/en/extensions.md).
+
 ## Understand the scope in 30 seconds
 
 | Tier | Keep here | How it reaches the Agent | Managed by |
@@ -52,7 +54,11 @@ The tiers are not copies. A useful rule is: **every-turn context goes to Runtime
 | **Archive Document** | A task Agent creates a searchable cold reference before the Host moves the original | Supervised move |
 | **Turn memory** | Expands exact recall, write, and Document-search activity; each item navigates to its source | Read-only |
 
-These tasks do not reuse or consume the main conversation history. By default they follow DSH's new-session model route; **Settings → Memory System → Background task Agent** can select a dedicated Provider and model. That fixed route applies to every Mnemon subagent delegation (idle checkpoint review, recall, write, answer, provider placement, memory migration, USER compaction, document archive, and metadata maintenance). With DSH 0.1.1-rc.2, the first-party `deepseek-official/deepseek-v4-flash-vision-exp` route appears with an **Image input** label. Mnemon background jobs still send text-only prompts; multimodal conversation messages keep their DSH attachment references through lifecycle processing, and raw image bytes are never copied into memory.
+Only the rows that explicitly name a task Agent spend a separate model context; **Search** and **Turn memory** are deterministic Host reads.
+
+Task Agents do not reuse or consume the main conversation history. By default they follow DSH's new-session model route; **Settings → Memory System → Background task Agent** can select a dedicated Provider and model. That fixed route also applies to bounded Mnemon workers for idle checkpoint review, writes, evidence-bound answers, provider placement, memory migration, USER compaction, Document archiving, and metadata maintenance. Conversation Recall and Related stay direct Host reads and do not use this background route.
+
+With DSH 0.1.1-rc.2, the first-party `deepseek-official/deepseek-v4-flash-vision-exp` route appears with an **Image input** label. Mnemon background jobs still send text-only prompts; multimodal conversation messages keep their DSH attachment references through lifecycle processing, and raw image bytes are never copied into memory.
 
 ## One Memory Space workflow, nine providers
 
@@ -197,7 +203,8 @@ See [Operations, security, and troubleshooting](./docs/en/operations.md) for bac
 | Configure scope, routing, and model selection | [Configuration](./docs/en/configuration.md) |
 | Back up, update, or troubleshoot | [Operations](./docs/en/operations.md) |
 | Integrate tools, commands, or RPC | [Interface reference](./docs/en/interfaces.md) |
-| Review the release | [v0.2.16 release notes](./docs/en/releases/v0.2.16.md) |
+| Build a Layer, Adapter, Strategy, Guard, or MemorySource extension | [Extension guide](./docs/en/extensions.md) |
+| Review the release | [v0.3.0 release notes](./docs/en/releases/v0.3.0.md) |
 
 See the [documentation hub](./docs/en/README.md) for the full map.
 

package/README.zh-CN.md

@@ -3,7 +3,7 @@
 <p align="center"><a href="./README.md">English</a> · <strong>简体中文</strong></p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/release-v0.2.16-5b5bd6" alt="发布版本 v0.2.16">
+  <img src="https://img.shields.io/badge/release-v0.3.0-5b5bd6" alt="发布版本 v0.3.0">
   <img src="https://img.shields.io/badge/%E8%AE%B0%E5%BF%86-3%20%E5%B1%82-087c5b" alt="三层记忆">
   <img src="https://img.shields.io/badge/Provider-9-c66a09" alt="九种 Provider">
   <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-43853d" alt="Node.js 20 或更新版本">
@@ -22,7 +22,7 @@
 <p align="center">
   <a href="./docs/zh-CN/capabilities.md"><strong>先看能力地图</strong></a> ·
   <a href="./docs/zh-CN/getting-started.md">5 分钟开始</a> ·
-  <a href="./docs/zh-CN/releases/v0.2.16.md">v0.2.16 升级说明</a> ·
+  <a href="./docs/zh-CN/releases/v0.3.0.md">v0.3.0 升级说明</a> ·
   <a href="https://github.com/omdsh-dev/dsh-mnemon/blob/e6ca446e45bdd17991f3c7c98560456de465282b/docs/assets/media/dsh-mnemon-memory-system-demo.mp4">观看宽屏实机演示</a>
 </p>
 
@@ -30,6 +30,8 @@
 
 [Mnemon](https://github.com/mnemon-dev/mnemon) 仍是官方优先的原生引擎。可以替换的是第三层；无论选择哪个 Provider，前两层的存储、工作区和交互心智保持不变。
 
+从 v0.3.0 开始，三层是可组合内核中的**默认拓扑**，不再是各入口各自写死的唯一结构。`MemoryBoot` 把受信任的 Layer、Adapter、Strategy、Guard 与 `MemorySource` 装配为一代运行图；每个用户回合固定一份轻量 `TurnView`：Runtime 精确内容 eager 进入 Wake，Documents 与 Memory Spaces 只给出有界路由封面，完整召回权限保留在 Host。用户仍只安装一个 `dsh-mnemon`，设置、工具、RPC 与 UI 工作流不变。参见[可组合架构](./docs/zh-CN/architecture.md#可组合记忆内核)与[扩展开发指南](./docs/zh-CN/extensions.md)。
+
 ## 30 秒理解能力边界
 
 | 层级 | 适合保存 | 如何进入 Agent 上下文 | 由谁管理 |
@@ -52,7 +54,11 @@
 | **归档档案** | 任务 Agent 先建立可检索冷引用，Host 验证后移动原文 | 受监督迁移 |
 | **本回合记忆** | 展开本轮召回、写入和档案检索；点击条目精确跳转 | 只读 |
 
-这些任务不会复用或挤占主对话历史。默认跟随 DSH 新建会话时的模型路由；也可以在**设置 → 记忆系统 → 后台任务 Agent**单独指定 Provider 与模型。该固定路由同时作用于 coordinator 派发的所有子代理委托（空闲复盘、召回、写入、问答、Provider 选择、记忆迁移、USER 压缩、档案归档、元信息维护）。在 DSH 0.1.1-rc.2 中，第一方 `deepseek-official/deepseek-v4-flash-vision-exp` 路由会标记为**图片输入**。Mnemon 后台任务目前仍只发送文本 Prompt；多模态对话消息在生命周期处理中保留 DSH attachment 引用，不会把原始图片字节复制到记忆。
+只有明确写出“任务 Agent”的行才会消耗独立模型上下文；**检索**和**本回合记忆**都是确定性的 Host 读取。
+
+任务 Agent 不会复用或挤占主对话历史，默认跟随 DSH 新建会话时的模型路由；也可以在**设置 → 记忆系统 → 后台任务 Agent**单独指定 Provider 与模型。该固定路由也作用于空闲复盘、写入、证据问答、Provider 选择、记忆迁移、USER 压缩、档案归档和元信息维护等受限 Mnemon worker；对话中的 Recall 与 Related 仍由 Host 直接读取，不使用后台路由。
+
+在 DSH 0.1.1-rc.2 中，第一方 `deepseek-official/deepseek-v4-flash-vision-exp` 路由会标记为**图片输入**。Mnemon 后台任务目前仍只发送文本 Prompt；多模态对话消息在生命周期处理中保留 DSH attachment 引用，不会把原始图片字节复制到记忆。
 
 ## 一套记忆体工作流，九种 Provider
 
@@ -197,7 +203,8 @@ dsh plugin --profile headless add "link:/absolute/path/to/dsh-mnemon"
 | 配置范围、路由与模型 | [配置参考](./docs/zh-CN/configuration.md) |
 | 备份、更新或排障 | [运维指南](./docs/zh-CN/operations.md) |
 | 接入工具、命令或 RPC | [接口参考](./docs/zh-CN/interfaces.md) |
-| 查看本次升级 | [v0.2.16 发布说明](./docs/zh-CN/releases/v0.2.16.md) |
+| 开发 Layer、Adapter、Strategy、Guard 或 MemorySource 扩展 | [扩展开发指南](./docs/zh-CN/extensions.md) |
+| 查看本次升级 | [v0.3.0 发布说明](./docs/zh-CN/releases/v0.3.0.md) |
 
 完整目录见[文档中心](./docs/zh-CN/README.md)。
 

package/SECURITY.md

@@ -6,7 +6,8 @@
 
 | Version | Supported |
 |---|---|
-| 0.1.x (npm `dsh-mnemon`) | ✅ |
+| 0.3.x (npm `dsh-mnemon`) | ✅ |
+| < 0.3 | ❌ |
 
 Only the latest published version receives security fixes. The plugin targets the DSH mainline snapshot it was verified against; see the compatibility baseline in [README.md](./README.md).
 
@@ -38,6 +39,7 @@ In scope:
 
 - The plugin bundle (`lib/`, `cordis.patch.yml`): data-loss, privilege-escalation, path-traversal, secret-leak, and memory-corruption style issues in plugin code.
 - The control plane: lock handling, revision conflict checks, atomic writes, and subagent isolation boundaries.
+- The composable-memory boundary: Catalog/Topology generation checks, Strategy permission enforcement, non-bypassable Kernel Guards, and Plan/Receipt integrity.
 - The WebUI: XSS or injection via rendered memory content.
 
 Out of scope:
@@ -49,7 +51,9 @@ Out of scope:
 ## Known limitations
 
 - There is no deterministic credential/secret detection today. Do not write keys, tokens, or private keys into Runtime Memory, Documents, or Memory Spaces.
-- Memory data is local; the plugin makes no remote calls, so remote-code-execution exposure is limited to what DSH and your providers already expose.
+- Cordis isolation provides lifecycle ownership and scope composition, not a security sandbox. Layer executors, Provider Adapters, Strategies, and Guards are ordinary JavaScript in the DSH Host process. Install extensions only from trusted sources.
+- Model-generated Strategy source is not executed automatically. Manifests, permission wrapping, replay, and Kernel validation reduce accidental authority but cannot make hostile in-process code safe.
+- Runtime Memory and Documents are local, and Mnemon Native is local by default. Enabled third-party Providers can make network or local-process calls and expose data according to their configured endpoints and credentials.
 
 ---
 
@@ -59,7 +63,8 @@ Out of scope:
 
 | 版本 | 支持 |
 |---|---|
-| 0.1.x（npm `dsh-mnemon`） | ✅ |
+| 0.3.x（npm `dsh-mnemon`） | ✅ |
+| < 0.3 | ❌ |
 
 仅最新发布版本获得安全修复。插件以验证时的 DSH mainline 快照为兼容基线，见 [README.zh-CN.md](./README.zh-CN.md)。
 
@@ -79,11 +84,13 @@ Out of scope:
 
 ### 范围
 
-**范围内**：插件 bundle 与 `cordis.patch.yml` 中的数据丢失、提权、路径穿越、秘密泄露类问题；控制面（锁、revision 冲突检查、原子写、子 Agent 隔离）；WebUI 对记忆内容渲染的 XSS/注入。
+**范围内**：插件 bundle 与 `cordis.patch.yml` 中的数据丢失、提权、路径穿越、秘密泄露类问题；控制面（锁、revision 冲突检查、原子写、子 Agent 隔离）；可组合记忆边界（Catalog/Topology generation、Strategy 权限约束、不可绕过的 Kernel Guard、Plan/Receipt 完整性）；WebUI 对记忆内容渲染的 XSS/注入。
 
 **范围外**：上游依赖（`mnemon`、`cordis`、DSH 核心、React）自身的问题（报告给上游，我们可协助定位与临时规避）；功能缺失、文档问题（走普通 issue）；你自行写入记忆数据中的凭据或秘密（插件当前没有秘密检测器，见 README 披露）。
 
 ### 已知限制
 
 - 当前没有确定性的凭据/秘密检测，请勿向热记忆、Documents 或 Memory Spaces 写入密钥、token、私钥。
-- 记忆数据全部本地存储，插件不发起远程调用；远程代码执行面受限于 DSH 与你的 provider 既有暴露面。
+- Cordis isolate 提供生命周期所有权和作用域组合，不是安全沙箱。Layer executor、Provider Adapter、Strategy 与 Guard 都是在 DSH Host 进程执行的普通 JavaScript，只能安装受信任来源的扩展。
+- 模型生成的 Strategy 源码不会自动执行。manifest、权限封装、replay 与 Kernel 校验可以降低意外越权，但无法让恶意同进程代码变安全。
+- Runtime Memory 与 Documents 为本地存储，Mnemon Native 默认本地；显式启用的三方 Provider 可能按配置 endpoint 与凭据发起网络调用或本地进程调用，并向对应服务暴露数据。