From a836f2d4ab51bc58cd742eff481856d9699392e0 Mon Sep 17 00:00:00 2001 From: Sami Rusani Date: Sat, 15 Aug 2026 11:44:24 +0200 Subject: [PATCH] v0.15.3 post-publication: record digests, flip state, sweep pointers v0.15.3 is published. PyPI reports it as the latest version, the GitHub Release is stable rather than a draft, and the project page now shows the AliceMemory repository URLs, which is the reason this release existed. Digests recorded in docs/release/v0.15.3-checksums.txt, verified from three sources that agree rather than copied from one: the PyPI JSON API advertises them, downloading the GitHub Release assets and hashing them locally produces the same values, and the published SHA256SUMS asset is a third reading. ae46ee24...c33d538f alice_memory-0.15.3-py3-none-any.whl acea1ccd...aef1932f alice_memory-0.15.3.tar.gz The post-rename publish path is now proven end to end. The trusted publisher scoped to the pypi environment authenticated on first attempt, which was the main thing this release was cutting early to find out. One process correction, and it is a correction rather than an addition. The rule recorded after v0.15.2 was "the release gate runs twice, from the branch and from the tag". That is necessary and it is not sufficient. The publish job requires every one of twelve exact-SHA checks to be complete AND successful on the release commit, and the semantic gate is only one of them. This release dispatched publish while Integration tests was still in progress on the release commit, and the gate correctly refused: identity verification failed with "latest required exact-SHA check did not succeed", every publish step skipped, nothing uploaded. The cost was one wasted dispatch. The rule is now to enumerate all twelve and confirm each is completed/success before dispatching. --- .ai/handoff/CURRENT_STATE.md | 18 +++++++----------- ARCHITECTURE.md | 10 ++++------ CURRENT_STATE.md | 18 +++++++----------- PRODUCT_BRIEF.md | 8 +++----- README.md | 8 +++----- RELEASING.md | 6 ++---- ROADMAP.md | 10 ++++------ docs/alpha/headless-ubuntu-install.md | 4 ++-- docs/integrations/reference-paths.md | 2 +- docs/release/v0.15.3-checksums.txt | 14 ++++++++++++++ docs/release/v0.15.3-release-notes.md | 2 +- docs/vnext/README.md | 8 +++----- 12 files changed, 51 insertions(+), 57 deletions(-) create mode 100644 docs/release/v0.15.3-checksums.txt diff --git a/.ai/handoff/CURRENT_STATE.md b/.ai/handoff/CURRENT_STATE.md index bcfe9cbe..cf6aa67c 100644 --- a/.ai/handoff/CURRENT_STATE.md +++ b/.ai/handoff/CURRENT_STATE.md @@ -2,10 +2,10 @@ ## Snapshot -- `v0.15.2` is the latest published release. It is available from PyPI and +- `v0.15.3` is the latest published release. It is available from PyPI and its record is immutable. `v0.13.1` is the prior published release, and GitHub; exact artifact digests are in - `docs/release/v0.15.2-checksums.txt`. `v0.13.1` shipped the Phase 4 + `docs/release/v0.15.3-checksums.txt`. `v0.13.1` shipped the Phase 4 core-roadmap work with the exact release headline **Replicated benchmark, faster SQLite at scale, reference integrations.** The `v0.13.0` tag exists but was never published (superseded; see the @@ -83,10 +83,10 @@ authoritative description; Phase 3 does not rewrite that history. ## Release Boundary -`v0.15.2` is tagged, published, and immutable. Its authoritative records are: +`v0.15.3` is tagged, published, and immutable. Its authoritative records are: -- `docs/release/v0.15.2-release-notes.md` -- `docs/release/v0.15.2-checksums.txt` +- `docs/release/v0.15.3-release-notes.md` +- `docs/release/v0.15.3-checksums.txt` `v0.13.1` remains published and immutable; its records are `docs/release/v0.13.1-release-notes.md` and `docs/release/v0.13.1-checksums.txt`. @@ -143,9 +143,9 @@ the `v0.14.0` release notes. update graph; it does not undo accepted project state or erase shared source evidence, upstream systems, exports, backups, or external logs. -## What `v0.15.2` Shipped +## What `v0.15.3` Shipped -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. The `v0.15.0` tag exists but was never published. The commit it points at @@ -153,7 +153,3 @@ carried a release-gate step that could not run on a CI runner, so the gate could never pass from that tag, and repository rules correctly refuse both deletion and update of stable tags. No GitHub Release or PyPI artifact was ever created for it. - -## What `v0.15.3` Targets - -`v0.15.3` is the current release candidate. It is not published. diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index f397d4f8..9161ee8b 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -3,11 +3,11 @@ ## Scope Boundary -- **Published boundary:** `v0.15.2` is the latest published release, +- **Published boundary:** `v0.15.3` is the latest published release, carrying the Phase 4 core-roadmap work (replicated benchmark evidence, SQLite vector scale, reference integrations, trace-only count diagnostics); artifact digests are in - `docs/release/v0.15.2-checksums.txt`. + `docs/release/v0.15.3-checksums.txt`. - **Prior published:** `v0.12.0` is the prior published release. It is tagged and immutable, passed the exact-SHA CI, semantic, and repository-control gates, and is published on PyPI with Trusted Publishing @@ -223,7 +223,7 @@ usage justifies a separately reviewed boundary. ## Current Architectural Posture -- `v0.15.2` is the latest published release and reconciles runtime and product +- `v0.15.3` is the latest published release and reconciles runtime and product identity around the agent interface, retrieval/memory quality, and a real-host-proven single-tenant deployment contract. - Phase 3 reduces `main.py` to app assembly and shared middleware, @@ -247,7 +247,5 @@ usage justifies a separately reviewed boundary. `docs/handoff/`; it does not constrain legitimate future production trees or approve them automatically. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published. diff --git a/CURRENT_STATE.md b/CURRENT_STATE.md index bcfe9cbe..cf6aa67c 100644 --- a/CURRENT_STATE.md +++ b/CURRENT_STATE.md @@ -2,10 +2,10 @@ ## Snapshot -- `v0.15.2` is the latest published release. It is available from PyPI and +- `v0.15.3` is the latest published release. It is available from PyPI and its record is immutable. `v0.13.1` is the prior published release, and GitHub; exact artifact digests are in - `docs/release/v0.15.2-checksums.txt`. `v0.13.1` shipped the Phase 4 + `docs/release/v0.15.3-checksums.txt`. `v0.13.1` shipped the Phase 4 core-roadmap work with the exact release headline **Replicated benchmark, faster SQLite at scale, reference integrations.** The `v0.13.0` tag exists but was never published (superseded; see the @@ -83,10 +83,10 @@ authoritative description; Phase 3 does not rewrite that history. ## Release Boundary -`v0.15.2` is tagged, published, and immutable. Its authoritative records are: +`v0.15.3` is tagged, published, and immutable. Its authoritative records are: -- `docs/release/v0.15.2-release-notes.md` -- `docs/release/v0.15.2-checksums.txt` +- `docs/release/v0.15.3-release-notes.md` +- `docs/release/v0.15.3-checksums.txt` `v0.13.1` remains published and immutable; its records are `docs/release/v0.13.1-release-notes.md` and `docs/release/v0.13.1-checksums.txt`. @@ -143,9 +143,9 @@ the `v0.14.0` release notes. update graph; it does not undo accepted project state or erase shared source evidence, upstream systems, exports, backups, or external logs. -## What `v0.15.2` Shipped +## What `v0.15.3` Shipped -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. The `v0.15.0` tag exists but was never published. The commit it points at @@ -153,7 +153,3 @@ carried a release-gate step that could not run on a CI runner, so the gate could never pass from that tag, and repository rules correctly refuse both deletion and update of stable tags. No GitHub Release or PyPI artifact was ever created for it. - -## What `v0.15.3` Targets - -`v0.15.3` is the current release candidate. It is not published. diff --git a/PRODUCT_BRIEF.md b/PRODUCT_BRIEF.md index 1c52f043..e984a3fb 100644 --- a/PRODUCT_BRIEF.md +++ b/PRODUCT_BRIEF.md @@ -15,13 +15,13 @@ Agent developers — people building or operating AI agents who need durable, ex - Local-first: your data stays on your machine; models and embeddings are pluggable via OpenAI-compatible endpoints. ## Current Posture -- `v0.15.2` is the latest published release and immutable baseline (Phase 5 +- `v0.15.3` is the latest published release and immutable baseline (Phase 5 enterprise track: real-host single-tenant deployment contract and least-privilege operations). `v0.13.1` is the prior published release. It carries the Phase 4 core-roadmap work (replicated benchmark, SQLite scale, reference integrations). Its PyPI wheel and source distribution have Trusted Publishing provenance, with exact digests in - `docs/release/v0.15.2-checksums.txt`. + `docs/release/v0.15.3-checksums.txt`. - `v0.11.0` shipped the Phase 1 periphery cut. It removes the Telegram, hosted/control-plane, public chat/response, chief-of-staff, and model-pack periphery so the default runtime matches the product described here. The @@ -63,7 +63,5 @@ Agent developers — people building or operating AI agents who need durable, ex - The MCP surface is small enough to learn in one sitting. - Every claim in the docs matches shipped behavior. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published. diff --git a/README.md b/README.md index db21b546..5fdbd227 100644 --- a/README.md +++ b/README.md @@ -141,7 +141,7 @@ search degrades to full-text only and says so explicitly in the retrieval trace. ## Status -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and release-note baseline (the `v0.13.0` tag was never published; superseded). Its tag, release record, and published artifacts are immutable. @@ -183,7 +183,7 @@ What that means in practice: - [v0.11.0 release notes](https://github.com/samrusani/AliceMemory/blob/main/docs/release/v0.11.0-release-notes.md) - [v0.11.1 release notes](https://github.com/samrusani/AliceMemory/blob/main/docs/release/v0.11.1-release-notes.md) - [v0.12.0 release notes](https://github.com/samrusani/AliceMemory/blob/main/docs/release/v0.12.0-release-notes.md) -- [v0.15.2 release notes](https://github.com/samrusani/AliceMemory/blob/main/docs/release/v0.15.2-release-notes.md) +- [v0.15.3 release notes](https://github.com/samrusani/AliceMemory/blob/main/docs/release/v0.15.3-release-notes.md) - [Release procedure](https://github.com/samrusani/AliceMemory/blob/main/RELEASING.md) - [Architecture](https://github.com/samrusani/AliceMemory/blob/main/ARCHITECTURE.md) - [Roadmap](https://github.com/samrusani/AliceMemory/blob/main/ROADMAP.md) @@ -201,7 +201,5 @@ If you discover a security issue, follow the process in [SECURITY.md](https://gi MIT — see [LICENSE](https://github.com/samrusani/AliceMemory/blob/main/LICENSE). -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published. diff --git a/RELEASING.md b/RELEASING.md index 8932e90f..e185a83f 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -2,7 +2,7 @@ -`v0.15.2` is the latest published release and remains the checksum/install +`v0.15.3` is the latest published release and remains the checksum/install baseline. Preparing candidate documents does not authorize a tag, PyPI upload, or GitHub Release. @@ -405,7 +405,5 @@ the tag and must not have claimed publication early. Verify checksum files on Linux with `sha256sum -c SHA256SUMS` and on stock macOS with `shasum -a 256 -c SHA256SUMS`. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published. diff --git a/ROADMAP.md b/ROADMAP.md index 2ab32b4a..6ce083ff 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -2,9 +2,9 @@ ## Baseline (Not Roadmap Work) -- `v0.15.2` is the latest published release. Its immutable release record is - `docs/release/v0.15.2-release-notes.md`, with artifact digests in - `docs/release/v0.15.2-checksums.txt`. (The `v0.13.0` tag was never +- `v0.15.3` is the latest published release. Its immutable release record is + `docs/release/v0.15.3-release-notes.md`, with artifact digests in + `docs/release/v0.15.3-checksums.txt`. (The `v0.13.0` tag was never published; superseded.) - `v0.11.0` shipped the Phase 1 periphery cut; `v0.11.1` shipped the Phase 2 debt sweep. Their tags, release records, and published artifacts are not @@ -85,7 +85,5 @@ restore, recorded security disposition) shipped in Phases 4 and 5. - OCR or transcription execution; Alice accepts text extracted elsewhere. - Re-expanding the default MCP surface beyond the eleven core tools. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published. diff --git a/docs/alpha/headless-ubuntu-install.md b/docs/alpha/headless-ubuntu-install.md index 346ab6c7..091d89fe 100644 --- a/docs/alpha/headless-ubuntu-install.md +++ b/docs/alpha/headless-ubuntu-install.md @@ -12,7 +12,7 @@ Supported assumptions for this alpha: This is the current headless install path for Alice. Install unreleased development code from `--branch main` or use the latest published release tag -(`v0.15.2`) for an immutable deployment. +(`v0.15.3`) for an immutable deployment. Historical note: `v0.5.1-vnext-preview` and `v0.6.0-alpha-rc.2` are older milestones kept for audit trail and rollback evidence. Do not install them for new setups; they predate the v0.6.0 overhaul (hybrid retrieval, consolidated core MCP surface, per-agent API keys). @@ -55,7 +55,7 @@ less install-alice.sh bash install-alice.sh --branch main --install-dir ~/alicebot ``` -For an immutable install after a release tag is published, replace `--branch main` with the latest published release tag (`v0.15.2`): `--tag v0.15.2`. +For an immutable install after a release tag is published, replace `--branch main` with the latest published release tag (`v0.15.3`): `--tag v0.15.3`. Use `--non-interactive` only after you have chosen a safe install directory and know whether the host should install local Postgres. diff --git a/docs/integrations/reference-paths.md b/docs/integrations/reference-paths.md index 2bb214b2..edd1f51f 100644 --- a/docs/integrations/reference-paths.md +++ b/docs/integrations/reference-paths.md @@ -1,7 +1,7 @@ # Reference Integration Paths This page is the path-selection guide for external builders adopting Alice on -top of the latest published `v0.15.2` baseline. Later changes on `main` are +top of the latest published `v0.15.3` baseline. Later changes on `main` are unreleased until they receive a release identity and publication evidence. diff --git a/docs/release/v0.15.3-checksums.txt b/docs/release/v0.15.3-checksums.txt new file mode 100644 index 00000000..cbb82a4e --- /dev/null +++ b/docs/release/v0.15.3-checksums.txt @@ -0,0 +1,14 @@ +# Alice v0.15.3 — published artifact SHA-256 digests +# +# These are the exact digests of the wheel and source distribution published +# to PyPI for v0.15.3 through GitHub Trusted Publishing. They also appear on the +# project's PyPI page and on the v0.15.3 GitHub Release assets, and are bound to +# this repository, the v0.15.3 tag, the publishing workflow, the exact commit, +# and the protected pypi environment by PyPI's integrity attestations (the +# /provenance endpoints). +# Linux verify: sha256sum -c v0.15.3-checksums.txt +# macOS verify: shasum -a 256 -c v0.15.3-checksums.txt +# Run either command beside the downloaded files. +# +ae46ee24a10a84a5c4cb1e9c2291053bd0ff504859d694e33f8eca0bc33d538f alice_memory-0.15.3-py3-none-any.whl +acea1ccdd719aae16f7d61f833004545036361bd10c096e638e63a94aef1932f alice_memory-0.15.3.tar.gz diff --git a/docs/release/v0.15.3-release-notes.md b/docs/release/v0.15.3-release-notes.md index a8567114..a93b08d9 100644 --- a/docs/release/v0.15.3-release-notes.md +++ b/docs/release/v0.15.3-release-notes.md @@ -1,5 +1,5 @@ # Alice v0.15.3 Release Notes - + **A maintenance release. The repository moved to `samrusani/AliceMemory`, and this is the first version published from it.** diff --git a/docs/vnext/README.md b/docs/vnext/README.md index 4bf96bf5..4bb1377d 100644 --- a/docs/vnext/README.md +++ b/docs/vnext/README.md @@ -8,7 +8,7 @@ capture, hardened connector settings/state/secrets, agent-facing context packs and context trees, governed agent proposals, and a local scheduler runtime. The vNext architecture is now the active Alice product line. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and latest-release-notes baseline. Its tag, release record, and published artifacts are immutable. `v0.12.0` shipped the Phase 3 structural refactor with **Structure only. Zero @@ -68,7 +68,7 @@ Alice vNext has three functional layers: 10. Use the current [release runbook](../../RELEASING.md) before publishing or tagging. The older [vNext preview checklist](../release/vnext-public-release-checklist.md) is retained only as historical evidence. -11. Review the [latest published release notes](../release/v0.15.2-release-notes.md) +11. Review the [latest published release notes](../release/v0.15.3-release-notes.md) and [known limitations](../alpha/known-limitations.md). 12. Review the [dogfood daily checklist](../runbooks/vnext-dogfood-daily-checklist.md) before daily local preview use. 13. Historical build-process summaries are archived under [docs/archive/process/](../archive/process/README.md). @@ -82,7 +82,5 @@ connector OAuth, packaged browser extensions, hosted connector polling, cloud sync, channel transport, OCR/transcription execution, a hosted SLA, or automatic promotion of generated artifacts into trusted memory. -`v0.15.2` is the latest published release and remains the install, checksum, +`v0.15.3` is the latest published release and remains the install, checksum, and baseline reference. - -`v0.15.3` is the current release candidate. It is not published.