memorix 1.9.4 → 1.9.6

package/CHANGELOG.md

@@ -2,7 +2,81 @@
 
 All notable changes to this project will be documented in this file.
 
-## [Unreleased]
+## Unreleased (1.9.x)
+
+No unreleased changes.
+
+## [1.9.6] - 2026-09-22
+
+### Added
+- **Task continuity ledger** -- adds a project-scoped append-only
+  ledger for requirements, decisions, verification, risks, and outcomes. The
+  bounded Project Context can include a ledger by `taskId`; no automatic
+  promotion or LLM summarization is performed.
+- **Continuity outcome projection** -- adds deterministic validated, at-risk,
+  in-progress, and unverified states plus replay coverage. Diagnostic scores are
+  exposed in receipts only and do not silently reorder memories.
+- **Infrastructure lifecycle closeout** -- bounds HTTP sessions and SQLite
+  handles, reuses project business runtimes behind fresh modern MCP protocol
+  shells, records event-loop/resource health, and adds a deterministic memory
+  quality gate.
+- **Atlas Cloud memory preset** -- `memorix init` and the configuration TUI can
+  select Atlas Cloud for optional background memory LLM work through its
+  OpenAI-compatible endpoint, with provider-specific key isolation.
+
+### Fixed
+- **Configuration scope isolation** -- explicit home/project resolution now
+  applies consistently to TOML, YAML, legacy JSON, and `.env` loading, so
+  long-lived processes and tests cannot reuse another configuration scope.
+- **OrcaRouter documentation** -- documents the existing OpenAI-compatible
+  gateway path with fixed-model and fallback guidance; no vendor-specific
+  provider branch is required.
+- **Capacity closeout** -- TeamStore queries, maintenance history, embedding
+  caches, HTTP project caches, and large-store behavior are bounded and
+  regression-covered.
+- **Stable coordination queue order** -- available tasks now dispatch FIFO with
+  a SQLite rowid tie-breaker, preventing cross-platform adapter-routing flakes
+  when task timestamps collide.
+- **Continuity correctness** -- verification obligations can move between
+  statuses by stable ID, retries are idempotent, open risks are visible in the
+  outcome state, and the 200-event cap is enforced transactionally.
+- **Replay-safe orchestration evidence** -- tool effects are recorded with
+  redacted fingerprints, risk tiers, replay policy, and unknown-after-crash
+  status without persisting raw tool arguments or output.
+
+## [1.9.5] - 2026-09-20
+
+### Added
+- **Setup HTTP MCP** -- `memorix setup --mcp http` honors Grok (writes a
+  `[mcp_servers.memorix]` URL in Grok `config.toml`) and rewrites installed
+  plugin/extension bundled MCP manifests from `memorix serve` to
+  `http://localhost:3211/mcp`. Default Grok MCP stays host-owned. Docs include
+  generic systemd user unit and LaunchAgent KeepAlive examples for
+  `memorix serve-http`.
+- **User-global store sync** -- `memorix sync store push|pull|status --scope user`
+  replicates every local project's eligible observations through the existing
+  opt-in relay. Default `--scope project` is unchanged. Privacy filters still
+  drop personal, agent-targeted, candidate, and ephemeral rows. The live
+  SQLite file is never copied.
+
+### Fixed
+- **HTTP control-plane safety** -- JSON request bodies are bounded, non-loopback
+  binds require an explicit Bearer token or unsafe opt-in, listen failures are
+  reported synchronously, background startup removes unverified state, and
+  shutdown waits for HTTP and SQLite resources to close.
+- **Project-scoped graph storage** -- graph entities and relations now carry a
+  project key, legacy JSONL migration recovers ownership from observation
+  references, and Dashboard/MCP graph access no longer crosses projects.
+- **Migration and lifecycle reliability** -- legacy observation/subdirectory
+  migrations use locks and atomic writes, malformed observation JSON fails
+  closed, stale file locks cannot evict a live writer, stateless MCP bindings
+  expire and are cleaned up, and SDK clients share resources safely.
+- **User-scope sync correctness** -- imported observation IDs are remapped on
+  collision, tombstones validate their source project, and user namespaces
+  must be explicit per-user values.
+- **Release contract** -- publish workflow validates tag/version/commit
+  identity, waits for npm visibility before MCP Registry publication, and
+  keeps prepublish checks non-mutating.
 
 ## [1.9.4] - 2026-09-18
 

package/README.md

@@ -89,7 +89,7 @@ Memorix is more than a memory store. It also installs agent integrations, keeps
 | Orchestration and team work | Task planning, worker handoffs, file locks, messages, verification gates, and review loops | `memorix orchestrate`, `memorix team`, `memorix lock` |
 | memcode | A bundled terminal coding agent that already reads and writes the same project memory | `memorix`, `memcode` |
 | CLI and SDK | Scriptable access for automation, imports/exports, diagnostics, and custom integrations | `memorix ...`, `createMemoryClient()` |
-| Optional multi-device sync | Project-scoped, privacy-filtered observation events with local SQLite kept canonical; GitHub JSONL, filesystem, S3, or Postgres relay | `memorix sync store status\|push\|pull` |
+| Optional multi-device sync | Privacy-filtered observation events with local SQLite kept canonical; default project scope, optional `--scope user` for every local project; GitHub JSONL, filesystem, S3, or Postgres relay | `memorix sync store status\|push\|pull` |
 
 <h2 id="works-with-your-agent"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/tags/light/section-agents.svg"><img src="assets/tags/section-agents.svg" alt="Works with every agent" height="32" /></picture></h2>
 
@@ -225,9 +225,10 @@ CLI, MCP, and HTTP are different entry points:
 
 Multi-device store sync is opt-in and separate from HTTP sharing. It never
 uploads the live SQLite database or WAL files. By default it only relays
-qualified project-visible observations; personal, agent-targeted, candidate,
-ephemeral, and other-project records stay local. Set `MEMORIX_SYNC_PROVIDER` and
-inspect `memorix sync store status --json` before the first push.
+qualified project-visible observations for the current Git project; personal,
+agent-targeted, candidate, and ephemeral records stay local. Pass `--scope user`
+to include every local project. Set `MEMORIX_SYNC_PROVIDER` and inspect
+`memorix sync store status --json` before the first push.
 
 <h2 id="install"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/tags/light/section-install.svg"><img src="assets/tags/section-install.svg" alt="Install" height="32" /></picture></h2>
 
@@ -298,7 +299,7 @@ What it installs depends on the target agent, but the goal is the same: make Mem
 - Oh-my-Pi: installs an `omp.extensions` package with extension hook events, a `memorix` command, official skills, and writes MCP config.
 - DeepSeek Harness: writes a Memorix `@deepseek-ai/dsh-mcp-client` row into `$DSH_HOME/cordis.patch.yml` (default `~/.dsh/cordis.patch.yml`), appends guidance to the harness `AGENTS.md`, and installs official skills under `$DSH_HOME/skills`. The row follows DSH's own shipped Memorix reference, so tools appear as `mcp__memorix__*`.
 - WorkBuddy: writes a Memorix MCP server row into `~/.workbuddy/mcp.json` (or `<project>/.workbuddy/mcp.json` for project installs) and appends guidance to `AGENTS.md`. Tools appear as `mcp__memorix__*`; there is no hooks surface.
-- Grok Build: installs native lifecycle hooks under `~/.grok/hooks/memorix.json` and guidance in `~/.grok/AGENTS.md`. It leaves Grok's MCP configuration host-owned; project-local hooks require Grok `/hooks-trust`, while global hooks are trusted. Set `GROK_HOME` to use a custom Grok home.
+- Grok Build: installs native lifecycle hooks under `~/.grok/hooks/memorix.json` and guidance in `~/.grok/AGENTS.md`. MCP stays host-owned by default; pass `--mcp http` to write `[mcp_servers.memorix]` with `url = "http://localhost:3211/mcp"`. Project-local hooks require Grok `/hooks-trust`, while global hooks are trusted. Set `GROK_HOME` to use a custom Grok home.
 
 Need a quieter install? Add `--noHooks` for targets where setup can control hook capture separately from the host's official package entry. It keeps MCP and guidance, but skips Memorix hook capture.
 
@@ -482,7 +483,7 @@ Long-term memory is deliberately not an automatic dump of every note. A source o
 | Use the bundled terminal agent | `memorix` or `memcode` |
 | Run orchestrated subagent work | `memorix orchestrate --goal "..."` |
 
-`memorix serve` defaults to `--mode micro` (9 tools) to keep MCP tool schemas small for agents. `memorix setup` writes `--mode lite` (20 tools) into the installed MCP config so the normal memory and session surface is reachable. Use `--mode team` (28 tools) for coordination tools, or `--mode full` (47 tools) for advanced and compatibility tools such as checkpoint inspection.
+`memorix serve` defaults to `--mode micro` (9 tools) to keep MCP tool schemas small for agents. `memorix setup` writes `--mode lite` (21 tools) into the installed MCP config so the normal memory, continuity, and session surface is reachable. Use `--mode team` (29 tools) for coordination tools, or `--mode full` (48 tools) for advanced and compatibility tools such as checkpoint inspection.
 
 Shortcuts and aliases: `memorix search` / `remember` / `recent` are direct query shortcuts, `bg`/`bs` start the background service, `hook` runs the hook launcher, and `memorix config get|path|migrate` inspects or migrates config files.
 
@@ -525,6 +526,11 @@ formation = "active"
 
 Use `[memory.llm]` and `[embedding]` for Memorix memory quality and retrieval. Use `[agent]` for the model memcode talks to while coding. Keep credentials in global config or environment variables, and do not commit secrets.
 
+For the optional Atlas Cloud memory preset, run `memorix init` and choose Atlas
+Cloud, or set `provider = "atlascloud"` in `[memory.llm]`. It uses the
+OpenAI-compatible `https://api.atlascloud.ai/v1` endpoint and reads
+`ATLASCLOUD_API_KEY` or the explicit `MEMORIX_LLM_API_KEY`.
+
 For OpenRouter embeddings, use `provider = "api"`, `base_url = "https://openrouter.ai/api/v1"`, and `model = "qwen/qwen3-embedding-8b"`. Memorix accepts `OPENROUTER_API_KEY` for that embedding endpoint; `MEMORIX_EMBEDDING_API_KEY` remains the explicit override.
 
 For controlled MiniMax media generation, set `MINIMAX_API_KEY` (global) or

package/README.zh-CN.md

@@ -84,7 +84,7 @@ Memorix 不只是一个记忆库。它还负责安装 Agent 接入、保留有
 | Orchestration 和团队协作 | 任务规划、worker 交接、文件锁、消息、验证门和 review loop | `memorix orchestrate`、`memorix team`、`memorix lock` |
 | memcode | 内置终端 Coding Agent，默认读写同一套项目记忆 | `memorix`、`memcode` |
 | CLI 和 SDK | 给自动化、导入导出、诊断和自定义集成使用的本地接口 | `memorix ...`、`createMemoryClient()` |
-| 可选多设备同步 | 按项目隔离、经过隐私过滤的记忆事件同步；本地 SQLite 仍是主库 | `memorix sync store status\|push\|pull` |
+| 可选多设备同步 | 经过隐私过滤的记忆事件同步；本地 SQLite 仍是主库；默认按当前项目，可用 `--scope user` 覆盖全部本地项目 | `memorix sync store status\|push\|pull` |
 
 <h2 id="支持你的-agent"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/tags/light/section-agents.svg"><img src="assets/tags/section-agents.svg" alt="Works with every agent" height="32" /></picture></h2>
 
@@ -219,9 +219,10 @@ CLI、MCP 和 HTTP 是不同入口：
 - `memorix background start` / `memorix serve-http` 是 HTTP 服务，用于共享端点、Dashboard、VPS Docker 部署或多客户端。
 
 多设备记忆同步是可选功能，和 HTTP 共享服务不是一回事。它不会上传
-`memorix.db`、WAL 或 SHM 文件。默认只同步当前项目中已确认且项目可见的
-观察记录；个人、指定 Agent、候选、短期和其它项目的记录会留在本地。设置
-`MEMORIX_SYNC_PROVIDER` 后，先运行 `memorix sync store status --json` 再 push。
+`memorix.db`、WAL 或 SHM 文件。默认只同步当前 Git 项目中已确认且项目可见的
+观察记录；个人、指定 Agent、候选和短期记录会留在本地。传入 `--scope user`
+可覆盖全部本地项目。设置 `MEMORIX_SYNC_PROVIDER` 后，先运行
+`memorix sync store status --json` 再 push。
 
 <h2 id="安装"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/tags/light/section-install.svg"><img src="assets/tags/section-install.svg" alt="安装" height="32" /></picture></h2>
 
@@ -291,7 +292,7 @@ memorix setup --agent grok --global
 - CodeBuddy Code：安装用户级本地市场插件到 `~/.codebuddy/memorix-local`，包含 MCP、skills 和 hooks。它不会修改既有的 CodeBuddy 模型、权限或 settings 文件；第三方 hook 仍由 CodeBuddy 自己的 `/hooks` 流程确认。
 - Oh-my-Pi：安装 `omp.extensions` package，包含 extension hook 事件、`memorix` command、官方 skills，并写入 MCP 配置。
 - DeepSeek Harness：向 `$DSH_HOME/cordis.patch.yml`（默认 `~/.dsh/cordis.patch.yml`）写入一行 Memorix `@deepseek-ai/dsh-mcp-client`，向 harness 的 `AGENTS.md` 追加使用规范，并把官方 skills 安装到 `$DSH_HOME/skills`。这一行遵循 DSH 自带的 Memorix 参考配置，因此工具以 `mcp__memorix__*` 形式出现。
-- Grok Build：把原生生命周期 hooks 安装到 `~/.grok/hooks/memorix.json`，把使用规范写入 `~/.grok/AGENTS.md`。Grok 的 MCP 配置仍由 Grok 自己管理；项目级 hooks 需要在 Grok 中执行 `/hooks-trust`，全局 hooks 默认可信；也可以用 `GROK_HOME` 指定自定义 Grok 目录。
+- Grok Build：把原生生命周期 hooks 安装到 `~/.grok/hooks/memorix.json`，把使用规范写入 `~/.grok/AGENTS.md`。默认仍由 Grok 自己管理 MCP；传入 `--mcp http` 时会写入 `[mcp_servers.memorix]`（`url = "http://localhost:3211/mcp"`）。项目级 hooks 需要在 Grok 中执行 `/hooks-trust`，全局 hooks 默认可信；也可以用 `GROK_HOME` 指定自定义 Grok 目录。
 
 如果你想要更安静一点的安装，可以对那些 setup 能独立控制 hook capture 的 target 加 `--noHooks`。它会保留 MCP 和使用规范，只跳过 Memorix 的 hook 自动捕获。
 
@@ -457,7 +458,7 @@ memcode
 | 使用内置终端 Agent | `memorix` 或 `memcode` |
 | 运行编排式 subagent 工作 | `memorix orchestrate --goal "..."` |
 
-`memorix serve` 默认使用 `--mode micro`（9 个工具），保持 MCP 工具 schema 紧凑。`memorix setup` 写入 `--mode lite`（20 个工具），覆盖常用记忆、会话、证据和反馈入口。需要协作工具时使用 `--mode team`（28 个工具），需要高级和兼容工具时使用 `--mode full`（47 个工具）。
+`memorix serve` 默认使用 `--mode micro`（9 个工具），保持 MCP 工具 schema 紧凑。`memorix setup` 写入 `--mode lite`（21 个工具），覆盖常用记忆、连续性、会话、证据和反馈入口。需要协作工具时使用 `--mode team`（29 个工具），需要高级和兼容工具时使用 `--mode full`（48 个工具）。
 
 `memorix orchestrate` 单 worker 默认使用当前 checkout；多 worker 时会在 `.worktrees/` 下为任务创建隔离 worktree，并把成功的任务分支 merge 回来。用 `--isolated` 可强制单 worker 也隔离，用 `--no-worktree` 禁用 worktree，用 `--allow-dirty` 允许带未提交改动运行，用 `--no-auto-merge` 保留任务 worktree 方便人工 review。
 
@@ -498,6 +499,11 @@ formation = "active"
 
 `[memory.llm]` 和 `[embedding]` 负责记忆质量和检索；`[agent]` 是 memcode 编码时使用的模型。凭据放全局配置或环境变量，不要提交 secrets。
 
+如需使用可选的 Atlas Cloud 记忆模型预设，可以运行 `memorix init` 选择
+Atlas Cloud，或在 `[memory.llm]` 中设置 `provider = "atlascloud"`。它使用
+OpenAI-compatible 的 `https://api.atlascloud.ai/v1` endpoint，并读取
+`ATLASCLOUD_API_KEY` 或显式的 `MEMORIX_LLM_API_KEY`。
+
 如果使用 OpenRouter embedding，可以设置 `provider = "api"`、`base_url = "https://openrouter.ai/api/v1"`、`model = "qwen/qwen3-embedding-8b"`。这个 endpoint 下 Memorix 会读取官方 `OPENROUTER_API_KEY`；需要单独覆盖 embedding key 时仍可用 `MEMORIX_EMBEDDING_API_KEY`。
 
 受控 MiniMax 媒体生成可在环境变量或 `.env` 中设置全局 `MINIMAX_API_KEY`，或中国区 `MINIMAX_CN_API_KEY`。媒体库不会保存该 key、临时签名 URL 或 base64 负载。CLI 生成本身就是显式操作；若要让 MCP 中的 Agent 发起生成，还必须明确设置 `MEMORIX_MCP_MEDIA_GENERATION=1`。