Sage

(S)AGE — Sovereign Agent Governed Experience

Persistent, consensus-validated memory infrastructure for AI agents.

SAGE gives AI agents institutional memory that persists across conversations, goes through BFT consensus validation, carries confidence scores, and decays naturally over time. Not a flat file. Not a vector DB bolted onto a chat app. Infrastructure — built on the same consensus primitives as distributed ledgers.

The architecture is described in Paper 1: Agent Memory Infrastructure.

Just want to install it? Download here — double-click, done. Works with any AI.

---

Architecture

Agent (Claude, ChatGPT, DeepSeek, Gemini, etc.)
  │ MCP / REST
  ▼
sage-gui
  ├── ABCI App (validation, confidence, decay, Ed25519 sigs)
  ├── Memory Auto-Voter (dedup, quality, consistency — one vote per node, signed with the node's consensus key)
  ├── Governance Engine (on-chain validator proposals + voting)
  ├── CometBFT consensus (single-validator or multi-agent network)
  ├── SQLite + optional AES-256-GCM encryption
  ├── CEREBRUM Dashboard (SPA, real-time SSE)
  └── Network Agent Manager (add/remove agents, key rotation, LAN pairing)

Personal mode runs a real CometBFT node with a per-node memory auto-voter — every memory write goes through pre-validation, a signed vote transaction, and the BFT quorum before committing. One node casts one vote; add more agents from the dashboard and each node votes with its own key, exactly the same consensus pipeline as a multi-node deployment.

Full deployment guide (multi-agent networks, RBAC, federation, monitoring): Architecture docs

---

CEREBRUM Dashboard

http://localhost:8080/ui/ — a dashboard-native operator console centered on the 3D MRI memory brain, with chain health, agents, federation, semantic memory, recall tuning, vault recovery, tasks, imports, and updates around it. Every major workflow is available from the browser; the CLI stays there for automation and recovery.

Control Board	Federation	Recall Engine
Chain health, quorum, agents, federation, and embeddings	One trust-only JOIN that prepares Direct and Secure relay automatically, followed by independent Read/Copy choices on each SAGE	Smart-memory setup, managed reranker install, and recall-depth tuning

The dashboard also includes agent management, domain permissions, key rotation, import/export, software updates, and encryption controls.

---

What's New in v11.19.11

CEREBRUM now supports operator-configured hostnames behind a local TLS reverse proxy. Set SAGE_ALLOWED_CEREBRUM_HOSTS to an exact comma-separated hostname allowlist when Caddy, Traefik, or another loopback proxy preserves the browser-facing Host instead of rewriting it to localhost. Ports are normalized and wildcards are deliberately unsupported.

The trust boundary stays local: the connected peer and every forwarded IP hop must still be loopback, unconfigured hostnames still fail closed, and browser origin matching accepts X-Forwarded-Proto only when every field-line and comma-joined token is a valid, case-insensitive http or https value and all hops agree. Empty, malformed, or mixed scheme chains are rejected.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.11. SDK 11.19.11.

What's New in v11.19.10

Returning agents can be reviewed normally again. When app-v26 retirement has handed an agent's former home domain to the stable Root principal, CEREBRUM reapproval now binds the existing owner and uses the established Root-to-agent recovery transfer for that exact recorded home. Fresh or operator-entered domains never receive an implicit transfer.

Rejecting a pending registration now counts active memories—the same lifecycle view shown by the recovery panel—instead of treating deprecated audit history as work the operator can still remediate. Active records continue to block ordinary rejection unless they are deprecated, transferred, or the explicit attribution-preserving force path is chosen.

This patch changes no consensus rule, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.10. SDK 11.19.10.

What's New in v11.19.9

Codex workspace identity resolution now fails closed at the filesystem root. A user-level Codex MCP process launched from / can no longer reuse the retired global-codex signer or auto-register the synthetic name codex//. SAGE rejects that broad, untrustworthy boundary before Git discovery, project-config lookup, key loading, or key generation. Real project and linked worktree roots continue to resolve to their stable workspace identities; operators who intentionally need a non-workspace shared identity must pin it explicitly with SAGE_IDENTITY_PATH.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.9. SDK 11.19.9.

What's New in v11.19.8

Access Groups now discover transferred historical domains, not only each member's enrollment-time home domain. CEREBRUM's bounded caller-domain projection consults the consensus-maintained current-owner index for the caller and active local group peers. A transferred user-* domain therefore appears as a usable exact recall or write target even when its current owner never authored a memory there.

Every discovered candidate is still re-authorized against current ownership, group authority, profile restrictions, and hard denies before it is returned. Per-record classification checks remain on the memory disclosure path. The result remains bounded and explicitly reports truncation; it does not expose a global domain roster, change ownership, copy grants, or weaken shared-domain and foreign-write restrictions.

This patch changes no transaction, AppHash input, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.8. SDK 11.19.8.

What's New in v11.19.5

Claim recovery and host wake coordination now survive real multi-transport runtimes. Both exact-local compatibility claim paths—GET /v1/pipe/inbox and explicit PUT /v1/pipe/{pipe_id}/claim—atomically bind the session and create its receipt, so ownership cannot commit without recovery evidence. MCP claimant identities are durable and transport-scoped across stdio, Streamable HTTP, and SSE; claimant_identity_mode discloses whether the identity is durable, a safe concurrent ephemeral fallback, inherited, or unavailable.

Claim transfer remains deliberate. sage_message_handoff requires the exact claimant_session_id and claim_revision returned by passive history; stale or A→B→A delayed transfers fail the revisioned compare-and-swap fence. The direct REST route preserves pre-v11.19.5 clients by treating an omitted from_revision as 0 only, so it can move an untouched first-generation claim but safely conflicts after any transfer. SAGE never steals a claim merely because it is old.

The new signed, payload-free GET /v1/inbox/activity-state returns exactly {version,epoch,seq} so host hooks can notice fresh task assignments and replies. The opaque 32-character database-incarnation epoch survives process restarts and backup restore, but changes for a fresh database so an old host cursor cannot suppress new cues after reinitialization. Those events remain nonblocking coordination: they do not change the exact three-field {version,seq,pending} contract of /v1/messages/wake or /v1/messages/wake-state, and they never make Stop treat a reply as unfinished work. Hooks can surface activity on the next prompt, but cannot resurrect an already-idle host task.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.5. SDK 11.19.5.

What's New in v11.19.4

Updater governance compatibility and recovery state are now one atomic proof. The replacement binary reports its own maximum supported application version. SAGE validates canonical pending-plan and active-ballot state against that exact ceiling while holding the same runtime read fence that pins the snapshot height and AppHash. Consensus cannot publish newer governance state between the compatibility decision and the verified recovery snapshot.

v11.19.3 acquired those two read fences separately. Its snapshot was coherent, but a concurrent Commit could make the preceding compatibility verdict stale. Personal single-node installs still upgrade normally in the app: v11.19.3 and v11.19.4 have the same app-v27 ceiling, the personal-node watchdog cannot create an unsupported app-v28 transition, and the updater performs the recovery snapshot, coordinated stop, final stopped-state snapshot, install, rollback, and restart automatically. No CLI or manual preflight is required. The stopped-node procedure in docs/UPGRADING.md is only for quorum or externally managed nodes where an operator can mutate governance during the v11.19.3 check-to-fence window.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.4. SDK 11.19.4.

What's New in v11.19.3

Normal upgrades now preserve compatible governance state automatically. The desktop updater reads the canonical pending plan and active proposal under one runtime-consistent view before changing the executable. A supported in-flight upgrade is included in the existing verified recovery snapshot and continues after restart; it is not a reason to interrupt the user or block the update. No terminal command, preflight ceremony, or governance expertise is required.

Malformed canonical state, an undecodable upgrade ballot, or a target newer than this binary supports still fails closed before executable mutation. The technical upgrade status and stopped-node upgrade preflight commands remain available for headless and quorum operators. Superseded safety notice: the v11.19.3 live updater did not hold one uninterrupted fence across that check and snapshot capture. That does not impose a CLI step on a personal node; only quorum or externally managed governance needs the coordinated stopped-node procedure when leaving v11.19.3.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.3. SDK 11.19.3.

What's New in v11.19.2

Binary replacement now has consensus-authoritative upgrade-governance proof. The read-only /upgrade/governance-status ABCI query reports the current application version, the exact pending upgrade:plan record, and the canonical state:gov:active proposal. Upgrade ballots include their decoded target application version. Storage, pointer/proposal identity, bounds, canonical-name, status, height, and payload-decode failures return ABCI code 1 instead of being misreported as an empty plan or ballot.

sage-gui upgrade status now consumes that fail-closed query rather than inferring safety from /abci_info plus the off-chain dashboard projection. The stopped-node sage-gui upgrade preflight command uses the same canonical inspector before the new server starts. v11.19.3 integrates that compatibility decision into the normal updater and lets supported in-flight operations continue automatically.

This patch changes no consensus rule, AppHash input, transaction type, key encoding, fork target, or application version. Existing app-v27 chains replay byte-identically.

Container: ghcr.io/l33tdawg/sage:11.19.2. SDK 11.19.2.

What's New in v11.19.1

Stranded message claims remain recoverable beyond the retained-history window. sage_inbox now embeds the first passive, payload-free page of unfinished claims held by another runtime sharing the same exact agent identity. Agents can continue through every older page with sage_message_history(folder="claimed_elsewhere"), then deliberately transfer an exact claim through the existing compare-and-swap sage_message_handoff path after deciding that its former claimant is dead or stale.

The recovery projection exposes only the message ID, claimant-session fence, timestamps, and local/federated classification needed for safe handoff. It does not expose sender identity, intent, payload, result, provider, or chain IDs. Expired TTL-bounded claims are also excluded consistently from both the exact diagnostic count and its recovery pages before the periodic expiry sweep runs.

Provider-addressed compatibility messages now bind atomically to the exact claiming agent and MCP session, resurface on later polls, support CAS handoff, and complete idempotently through sage_message_reply. A failed reply explicitly does not authorize creating a substitute sage_message_send; agents must recover the original claim or report the failure. Existing claimed provider rows receive an off-chain SQLite legacy session fence during startup migration.

This patch introduces no consensus change or application-version increase. The supported consensus ceiling remains app-v27.

Container: ghcr.io/l33tdawg/sage:11.19.1. SDK 11.19.1.

What's New in v11.19.0

Record authors regain lifecycle authority in reserved shared namespaces. After app-v27 activates, the immutable author of a record in general, self, meta, or sage-* may challenge that record and may reinstate its open challenge without separately holding a level-3 Modify grant. The exception is record-scoped and does not apply to governance-promoted shared domains. Pending or inactive enrollment, read-only/profile restrictions, shared-write denies, and classification/clearance failures still deny the action. App-v21 weighted challenge rounds include the eligible record author in their frozen electorate.

Omitted task status now has one canonical meaning. After app-v27, a signed new-task request that omits task_status is canonicalized to planned by both REST transaction construction and consensus proof verification. Pre-app-v27 chains retain the historical requirement to send task_status: "planned" explicitly, preserving replay and AppHash compatibility.

App-v27 is a governed consensus upgrade from app-v26 with no state migration. Its rules begin at H+1 after activation; older blocks replay under their original application version.

Container: ghcr.io/l33tdawg/sage:11.19.0. SDK 11.19.0.

What's New in v11.18.28

Reserved shared domains are readable again without becoming ownable. Active local principals can read the compile-time shared namespaces general, self, meta, and sage-*, while each record's classification still applies. This restores the shared-domain behavior expected by existing agents without opening private or restricted records.

Access-grant transactions now reject attempts to register either those reserved namespaces or governance-promoted shared domains as owned domains. REST reports that conflict as a forbidden request, and the API, SDK, and RBAC references now state the same contract.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.28 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.28. SDK 11.18.28.

What's New in v11.18.27

Empty semantic recall now distinguishes genuine absence from an incomplete vector-space view. For an empty, domain-scoped semantic query, index_status reports complete, incomplete, or fail-closed unavailable only when the caller and exact query universe support that conclusion. The same signal is relayed through sage_recall and sage_turn, so write-on-absence agents can avoid manufacturing duplicates when committed memories are temporarily unreachable in the active embedding space.

The proof is caller-safe and race-fenced across canonical projection, SQL, embedding-space, and vault generations. Narrowed or federated queries and unhealthy projections never receive a false completeness claim, while bounded indexed probes keep the empty-result path operationally safe.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.27 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.27. SDK 11.18.27.

What's New in v11.18.26

The supported Go dependency baseline is refreshed. This release carries the validated testify 1.12.0, x/crypto 0.55.0, and x/tools 0.49.0 module updates already exercised by the full repository gate.

Code scanning and native-shell CI actions are refreshed to their pinned current revisions. CodeQL runs with the updated action bundle and the native shell cache action is updated, without changing SAGE runtime behavior.

HTTP MCP tokens now bind to existing approved managed identities. On app-v23 nodes, token creation no longer generates an unapprovable pending principal: Root/Admin selects an active ordinary agent already managed by the node, and issuance fails closed if its exact key is unavailable. The CLI also handles mcp-token create --help without minting a credential and rejects unknown creation flags.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.26 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.26. SDK 11.18.26.

What's New in v11.18.24

Federated inbox work now has recoverable, session-fenced ownership. SAGE binds an inbound federated claim to the receiving MCP session before exposing its payload. Retained older claims receive an explicit legacy CAS fence for deliberate handoff; live work is never stolen by a timeout. Reply completion, the claimant check, encrypted result fingerprint, and durable return event now commit atomically, so a lost-response retry returns the original event while a different second reply conflicts.

MCP boot guidance no longer rides inside ordinary tool results. Lifecycle standing stays in initialize.instructions, including for a client that initializes after its first tool call. The former imperative block that asked an agent to invoke tools and edit a memory file has been removed, keeping the inbox trust boundary internally consistent.

Embedding-space and retention diagnostics are more precise. The readiness guard labels only a qualified-versus-bare spelling of the same provider/model leaf/dimension as a likely alias, without collapsing two organizations that publish the same basename. Durable-until-handled presentation is limited to actionable pending/claimed work, while mixed-version retention-only responses remain compatible.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.24 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.24. SDK 11.18.24.

What's New in v11.18.23

Turn-time recall now carries the same trust and lifecycle evidence as explicit recall. sage_turn includes each recalled memory's corroboration_count and status, so the every-turn path no longer hides corroboration weight or whether a recalled row is committed or currently challenged.

Embedding-space drift is visible before it silently empties semantic recall. At boot, SAGE compares the active embedder with the non-deprecated vector spaces already in the local store. A mismatch produces a loud warning and a structured embedding_space block in /ready; the node remains available by default while strict readiness returns 503, allowing an intentional re-embed migration to finish instead of turning a quality warning into an outage.

Managed reranker setup now diagnoses incompatible prebuilt engines. After a verified install, SAGE preflights llama-server. Proven GLIBC, GLIBCXX, or CXXABI loader failures preserve the loader's real error and point operators to the bring-your-own reranker path instead of reporting a successful unusable install.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.23 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.23. SDK 11.18.23.

What's New in v11.18.22

A missing optional ForceGraph API can no longer strand CEREBRUM after the verified brain has rendered. The renderer now publishes the core graph and truthful counts before optional anatomical, control, and interaction setup. The bundled runtime's absent clickAfterDrag helper is feature-gated, so the brain hull, controls, and auto-rotation continue instead of falling into the cold unavailable path with real nodes already on screen.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.22 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.22. SDK 11.18.22.

What's New in v11.18.21

A domain-summary refresh can no longer cover a verified MRI graph. The MRI renderer is now the sole authority for the central unavailable overlay. Domain inventory failures stay localized to their own retrying panel, while genuine cold graph failures and unsafe mode switches remain fail-closed.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.21 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.21. SDK 11.18.21.

What's New in v11.18.20

A transient MRI refresh no longer hides a graph CEREBRUM has already verified. Memory and Connectome snapshots now retain their explicit source mode. If a live refresh fails, CEREBRUM keeps the last verified snapshot visible only when it belongs to that same mode, while retrying in the background. Cold failures and failed mode switches still fail closed, so Connectome bytes can never masquerade as a verified memory projection.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.20 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.20. SDK 11.18.20.

What's New in v11.18.19

Codex project hooks stay inside their project. The v11.18.18 byte-exact self-healer could mistake Codex's user-global ~/.codex configuration directory for a project and generate a global hooks.json. That made an unrelated Codex task receive SAGE inbox Stop nudges for the shared agent identity. The healer now refuses the user-home/global scope; project-local hooks continue to self-repair.

Connectome clicks now have one hit-tested owner. The redundant DOM click fallback that raced ForceGraph's deferred node click is gone. Small pointer wobble is handled by one explicit tolerance, background dismissal uses the graph's raycast result, and clicking a second neuron no longer closes the inspector and starts a competing zoom-out first. Raw domain-access metadata is summarized behind a bounded disclosure below traffic, relationships, and memory details; bloomed memory nodes now expose hover and accessible click feedback.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.19 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.19. SDK 11.18.19.

What's New in v11.18.18

Codex upgrades now repair stale SAGE lifecycle hooks automatically. On every MCP startup, the project self-healer compares all five installer-owned Codex hook scripts with their fully rendered current templates. A mixed generation can no longer pass merely because the files exist or another hook mentions the current binary. Upgrading therefore replaces legacy no-op Stop hooks and malformed prompt hooks without requiring a second manual sage-gui codex install run.

The CEREBRUM Connectome now leads with the graph itself. Neurons have a larger practical click target; clicking one opens its persistent identity, visible incoming/outgoing traffic, strongest peer, directed connection list, and visible memory lobe. The compact fallback selector now shows only agents with visible peer relationships, ordered by retained traffic, instead of turning a large dormant/test roster into the primary navigation surface. Isolated authorized neurons remain visible and clickable in the brain and join the selector while selected.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.18 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.18. SDK 11.18.18.

What's New in v11.18.17

Routine MCP restarts no longer make the same stdio agent disown its own unfinished messages. The primary stdio runtime now persists one opaque claimant identity per exact signed agent, provider, and project under SAGE_HOME, and holds an OS advisory lock as the liveness fence. A later runtime reuses that identity only after the earlier process is no longer live; a genuinely concurrent runtime receives an independent identity and retains the existing one-handler and compare-and-swap handoff boundary. In-place installed-binary handoff also carries the current claimant identity while the old process keeps the lock alive.

The fix is deliberately prospective and does not bulk-transfer historical claims created by pre-v11.18.17 random process identities. Those rows remain visible through claimed_elsewhere_count and passive history and can still be transferred one at a time with the existing CAS-fenced handoff after the old claimant is known dead. HTTP MCP conversations remain transport-scoped. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.17 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.17. SDK 11.18.17.

What's New in v11.18.16

Claimed agent work no longer disappears from the inbox that claimed it. sage_inbox now returns a separate bounded own_claimed_unfinished projection for messages already owned by the exact current agent session. The projection is passive: it never claims, refreshes, transfers, or duplicates work, and it does not change the established items or count meaning of newly available work. Exact agent/session filtering, completion and expiry handling, bounded results with an exact total, reply-after-repoll, and nonmutation are pinned by store, REST, and MCP regression coverage.

The payload-free hook status path also checks the durable wake snapshot, so claimed-but-unfinished work cannot be reported as a clean inbox merely because no unclaimed row remains. Older or temporarily incapable nodes degrade to an explicit unavailable state instead of either a false zero or a failed primary inbox call. This patch does not automatically transfer claims from another session; passive history plus explicit compare-and-swap handoff remain the recovery boundary. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.16 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.16. SDK 11.18.16.

What's New in v11.18.15

Every unfinished exact-recipient local canonical message now has a durable wake generation, including upgrade-era claimed-only work and sends through the deprecated pipe route. Startup backfill covers both pending and claimed rows, so a recipient whose only live work was already claimed cannot reopen as the silent {seq:0,pending:true} state. Keyed exact-local pipe sends use the canonical idempotent admission path; unkeyed sends insert the row and advance the same recipient sequence atomically. Publication happens only after commit, exact replays do not republish, and an incapable backend fails before insertion rather than creating durable work that wake consumers cannot observe as new.

The experimental Claude notification adapter is explicitly opt-in again. The shipped Claude Code host registers the custom notification handler, but end-to-end delivery from a plain .mcp.json server through its plugin-scoped gate remains unverified. An idle adapter would also acquire the one exact-agent wake lease and exclude a useful long-running consumer. SAGE_CLAUDE_CHANNEL=true enables it for an operator who has confirmed that delivery path.

Pending-memory presentation is deterministic even when creation timestamps tie: SQLite and PostgreSQL both use memory_id as the final ordering key. The documentation citation guard now parses newline-separated and hyphenated paths, pins every concrete declaration/lead/interior anchor, repairs only explicitly accepted declaration anchors, refuses semantic locations it cannot reconstruct, and inventories the remaining legacy skipped and bare references. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.15 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.15. SDK 11.18.15.

What's New in v11.18.14

Durable agent messages now stay visible until the work is actually finished. Claiming a message no longer makes the payload-free wake surface go quiet: both pending and claimed rows remain unfinished, a reconnect at the current cursor receives an immediate wake, and sage_inbox reports an exact payload-free claimed-elsewhere state instead of a bounded-scan false zero. Claude Code project sessions arm the signed wake channel by default, while the optional Stop hook reads a lease-free monotonic snapshot so new or stranded work can nudge a session once without stealing the live SSE consumer lease.

The same recovery path is honest at its edges. A claimant-session fence rejection remains a typed conflict instead of masquerading as a missing message, and history plus explicit compare-and-swap handoff remain the only way to recover another session's claim. Canonical retention migration now rescues only the exact historical 24-hour stamp, preserving a sender's chosen bounded TTL across every store reopen, including RFC3339 nanosecond timestamps.

CEREBRUM's Connectome now identifies the agents it renders. Hover details are positioned and escaped reliably, while click, tap, and keyboard selection open one persistent inspector with exact agent identity, visible retained traffic, peers, activity, and an independently loading visible-memory lobe. Selection survives authorized live refreshes, error and empty states stay truthful, mobile uses a bounded sheet, and reduced-motion and established Connectome guidance remain intact.

Agent-as-lobe corroborator reads now use one deterministically ordered bounded batch instead of an N+1 query pattern, with matching SQLite and PostgreSQL ordering. The MCP contract also states the server-enforced 31-day sage_timeline range rather than advertising requests the server rejects. This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.14 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.14. SDK 11.18.14.

What's New in v11.18.13

Hubanov's distributed-engram contribution now connects memories to the neurons that corroborated them. CEREBRUM keeps agent and memory identities in separate graph namespaces, rejects stale bloom generations, and removes every transient bridge on focus or graph replacement. The server uses a deterministic, indexed 96-row evidence prefix and exposes at most 12 authorized bridges without turning historical corroboration into a claim of current possession.

Claude's production wake source can now arm the payload-free message bus. When explicitly enabled with SAGE_CLAUDE_CHANNEL, the MCP runtime consumes the existing signed SSE wake route with a random process lease and resumable cursor. Delivery applies backpressure instead of dropping the newest wake, and shutdown releases saturated readers without leaking goroutines or claiming message content.

The Connectome no longer floats an instructional card over the brain. Its guidance lives in the existing reading panel, the mode toggle keeps one stable name and visible pressed state in both themes, keyboard focus remains clear, mobile Reset behavior stays intentional, and view changes are announced to assistive technology.

This patch also closes a claimant-session compatibility bypass: a current typed 404 is authoritative, the deprecated pipe-result alias carries the active MCP session, and only a genuine old-node route miss may fall back. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.13 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.13. SDK 11.18.13.

What's New in v11.18.12

CEREBRUM can now open an agent as a memory lobe. Selecting a connectome neuron lazily blooms that agent's highest-confidence visible memories as engrams, while retaining the operator-only route and app-v23 per-record projection checks. The indexed, bounded query avoids whole-brain scans; stale, failed, and disposed frontend requests cannot leave another agent's lobe on screen.

Dashboard live activity is now guarded as one exact 20-event registry. The seven previously unwired operator events now reach the existing dashboard SSE stream, while message wake, MCP, and wizard protocols stay route-local. A fail-closed typed control-flow audit and executable browser contract reject dead, aliased, escaped, build-tagged, or decoy event sinks.

Signed task creation and message attribution now agree end to end. Every official task constructor explicitly signs the required initial planned status, and REST fails fast instead of mutating an omitted signed field into a transaction that app-v23 through app-v26 must reject. Authorized message and pipe responses retain exact immutable agent IDs alongside mutable presentation labels, use one bounded batch metadata query on healthy production stores with a bounded exact-ID fallback, suppress foreign-chain label collisions, and keep count-only responses identity-free.

This patch also repairs release-facing documentation drift, pins the current 33-tool MCP inventory, and adds fail-closed symbol/citation coverage for the references it can verify. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.12 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.12. SDK 11.18.12.

What's New in v11.18.11

The CEREBRUM connectome now fires live without widening its operator-only boundary. Successful local message sends emit a contentless invalidation tick; the browser then refetches the existing caller-filtered snapshot and pulses only newly observed synapses. Monotonic generations preserve later ticks across in-flight requests, ordinary reloads, failures, and retries, while initial loads and unrelated refreshes never create false activity.

Dashboard retrieval activity no longer duplicates authorized memory plaintext into the global operator stream. Recall, search, and hybrid events now expose only their event type and result count. The obsolete expandable plaintext panel is gone, and serialized-frame regressions pin the contentless contract and live, non-replayed delivery.

Claude bookend sessions can discover waiting SAGE messages without claiming or revealing them. A signed, payload-free inbox-status hook reports only the current identity and unread count, makes failures visible, preserves unrelated user hooks during self-heal, and exposes the read-only message tools needed to perform the explicit inbox fetch.

This patch also keys local connectome locality by chain identity, removes a stale app-v7 validator warning after app-v14, dims the connectome skull for legibility, requires patched Go 1.25.13 throughout current builders and CI, and publishes checksum sidecars for Windows executables. It introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.11 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.11. SDK 11.18.11.

What's New in v11.18.10

Multiple MCP runtimes sharing one agent identity can no longer silently lose track of claimed messages. Every MCP conversation now has an opaque claimant session ID. Atomic inbox claims persist that session in passive history, an explicit compare-and-swap handoff transfers work between runtimes, and a stale former owner is rejected if it tries to reply after ownership moved. Receive tokens remain replay-safe after a lost response, while legacy direct REST clients retain their existing agent-level compatibility path.

CEREBRUM can render the agent message bus as a live connectome inside the 3D brain. Registered agents become domain-coloured neurons, directed channels become traffic-weighted synapses, and hub agents settle toward the core. The view consumes the existing RBAC-filtered synapse projection, drops ghost edges, and fences asynchronous mode switches so a slow memory response can never be displayed as connectome data.

Upgrade-watchdog submissions can no longer hold a signing key's nonce lease for the process lifetime when CometBFT wedges. One bounded context now covers both lease acquisition and the broadcast. A deadline after submission remains a typed indeterminate outcome, so the exact signer and bytes stay fenced until their fate is reconciled; elapsed time never releases the key fail-open.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.10 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.10. SDK 11.18.10.

What's New in v11.18.9

Ambiguous CometBFT commit and sync outcomes are now typed at the shared broadcaster boundary. Transport, status, RPC, decode, shape, hash-binding, and missing-height failures return ErrSubmitIndeterminate for valid signing keys, while the existing live-registration path remains an independent fence backstop. Pre-send request-construction failures remain definitive and do not fence a key over bytes that never reached a transport.

Federation sync now fails closed if its commit broadcaster ever violates its contract by returning neither a result nor an error. The exact signer and encoded transaction remain fenced until reconciliation proves their fate, instead of releasing the key for a potentially in-flight transaction. A new cross-package decoder contract also pins the HTTP prologue shared by internal/tx and the CEREBRUM web path while recording their deliberate verdict and envelope-tolerance differences.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.9 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.9. SDK 11.18.9.

What's New in v11.18.8

CometBFT transaction submissions no longer permit Go's HTTP transport to transparently redeliver a fenced request after a reused connection fails while reading the response. Commit, sync, byte-identical nonce-fence reconciliation, and CEREBRUM submission paths now share a non-reusing HTTP/1.1 transport seam. Each submission call writes its transaction on one connection and returns an indeterminate result instead of silently delivering the same signed bytes to a second responder. Restart failure reporting also preserves the signer-fence veto ahead of a generic drain timeout.

MCP reply polling now fails safe when a caller presents an unsafe forward watermark. If reply_since is later than the authoritative retained-reply head, or no head exists to validate it, sage_inbox returns the newest passive reply page for deduplication instead of filtering a formal reply into a false empty result. Complete recovered pages become a new safe baseline; truncated pages require composite-cursor catch-up, and failed page reads never claim recovery. A successful outbound sage_message_send also performs one bounded, sender-exact passive inbox snapshot so an inbound message that arrived after an earlier empty poll is surfaced during continued coordination.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.8 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.8. SDK 11.18.8.

What's New in v11.18.7

Large signed transactions now use a bounded CometBFT transport instead of overflowing request headers. Existing smaller broadcasts keep the established GET wire shape, while large commit, sync, and byte-identical nonce-fence reconciliation requests use JSON-RPC POST with base64 transaction bytes. Client transaction and JSON-RPC body limits are independently range-checked, capped at 8,000,000 bytes, and refuse an oversized request before send. Operators raising them must configure matching CometBFT limits. Independently, every validator enforces a 1,200,000-byte aggregate raw-transaction budget for app-v20 atomic finalization, sufficient for the measured 1,304-entry SkillRegistry transaction. Memory content remains bounded at 512 KiB, while the canonical signed AgentRequest proof has its own 600,000-byte consensus bound, admitting the measured 573,723-byte proof without widening the content or aggregate limits. Response handling accepts strict quoted or numeric int64 heights, rejects fractional, exponent, null, malformed, and out-of-range heights, and refuses unsupported content types.

Federation route refresh no longer risks recursively acquiring the sync-policy read lease from a peer-request caller. Opportunistic refresh admission is policy-free and bounded to one pending refresh per peer; the agreement and binding lookup runs asynchronously after the request caller can release its lease. Failed-request and successful-Direct triggers remain covered, while the route-exchange endpoint does not self-trigger refresh.

P2P-only peers can recover when their stored route snapshot is missing or belongs to an older trust generation. Only the authenticated /fed/v1/p2p/routes bootstrap exchange may use stale or current route addresses as connection hints; the current agreement's pinned mTLS identity remains authoritative. Protected requests reject missing or cross-generation snapshots with trust_generation_mismatch. A matching-generation empty target set remains explicitly pinned and cannot fall back to current configuration.

Federation diagnostics now give security evidence precedence over route availability evidence. Mixed route-availability plus certificate, SPKI, pin, identity-mismatch, or security-block evidence is classified as security_blocked; revocation, expired or unknown agreement, trust-failure, or authentication evidence is classified as trust_failure. Both verdict classes outrank route availability.

This patch introduces no new consensus application version or state migration. The ceiling remains app-v26; v11.18.7 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.7. SDK 11.18.7.

What's New in v11.18.6

Updater snapshots now prove both supported CometBFT layouts before they are published or reused. Application Badger and persisted consensus state must match at height H and agree on the application hash. A blockstore committed through H is accepted only after its H block ID and seen commit match that state. If the blockstore is durably one block ahead at H+1, SAGE additionally verifies the complete block and part identity, direct-parent and state-derived header fields, last and seen commits, validator signatures, and CometBFT's replay-time block validation. Regression coverage restores the candidate and runs the real CometBFT handshaker, proving exactly one replayed block and safe restart reuse. Malformed or more-than-one-ahead provenance is rejected, and an invalid prior publication is quarantined before a valid replacement can be published. Cancellation always blocks executable updater handoff, although a safe snapshot may already have been atomically published. Non-empty H+1 evidence is retryable until application and state catch up.

Federation Retry now performs one bounded, exact-generation recovery workflow. Concurrent operator clicks share the same route refresh and authenticated status probe. Direct and relay targets are frozen to the active JOIN generation, HTTP 401/403 and certificate/identity failures stop before re-probing, and a revoke or re-pair during the response invalidates the result. Typed dashboard diagnostics distinguish missing or expired route bundles, stale Direct routes, unavailable relays, trust-generation changes, and legacy connections that must be paired again. Ordinary polling and mutating requests do not enter this retry path.

Memory-reassignment audit failures no longer place request-controlled agent IDs in logs. The source and target are represented by fixed 96-bit truncated SHA-256 fingerprints (24 lowercase hexadecimal characters), preserving stable incident correlation without allowing CR/LF or other control characters to forge log records.

This patch does not change consensus state or application activation. The ceiling remains app-v26; v11.18.6 introduces no app-v27. The signer fence also remains process-local: unresolved submissions still require proof of fate, and crash/restart or a separate signing process is not claimed safe until durable cross-process pre-broadcast intent exists.

Container: ghcr.io/l33tdawg/sage:11.18.6. SDK 11.18.6.

What's New in v11.18.5

Long-lived stdio MCP sessions now follow an installed SAGE upgrade without executing a request under stale tools. The MCP process snapshots the exact executable that started it. If the app bundle or binary is atomically replaced, the next unread JSON-RPC frame is handed to the new executable together with the remaining stdio stream. The upgraded runtime—not the stale process—receives that request. The old runtime never executes the handed-off frame; transport failure remains an ordinary indeterminate outcome for callers to reconcile. Sessions initialized on 11.18.5 advertise MCP tool-list change support; the replacement emits notifications/tools/list_changed only after the logical session has completed initialization, so conforming clients refresh cached definitions as well as runtime behavior.

The unified coordination response identifies its live contract. Every sage_inbox result now carries coordination_schema: "sage.inbox.v2", the running mcp_runtime_version, and sender_replies_embedded: true|false. Monitors can therefore reject or report a stale pointer-only session instead of silently assuming that an empty addressed inbox also means no threaded reply arrived. The existing bounded reply_items, inclusive watermark, composite catch-up cursor, and passive sender-only authorization remain unchanged.

The upgrade from a pre-11.18.5 MCP process still requires one agent-session restart because that already-running older process cannot contain this handoff logic. Once a session starts on 11.18.5 or later, subsequent binary replacements use the automatic request-preserving handoff. Clients that ignore the negotiated tool-list notification must still re-list tools or reconnect to discover new definitions.

The consensus ceiling remains app-v26; v11.18.5 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.5. SDK 11.18.5.

What's New in v11.18.4

One inbox poll now surfaces both new work and threaded answers. sage_inbox returns replies to messages you sent under the separate passive reply_items key by default, while genuine inbound work remains under items. Reply rows never inflate work counts and explicitly require no reply. Inclusive reply_since polling prevents same-millisecond loss; truncated pages fail safe with an exact composite-cursor catch-up action and forbid advancing the watermark until the window is drained.

Release builders now enforce the patched Go floor. Root and natter modules require Go 1.25.12, CI and release jobs resolve that exact go.mod toolchain, every Go container builder uses 1.25.12, and pinned govulncheck v1.6.0 scans both modules before either CI fan-in or release publication can pass.

Legacy pipeline retention compares time chronologically and conservatively. SQLite purge eligibility no longer relies on variable-width RFC3339 text. Cutoffs are floored to SQLite's millisecond precision, so ambiguous same-millisecond rows are retained rather than deleted early; malformed read evidence also retains fail safe.

The consensus ceiling remains app-v26; v11.18.4 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.4. SDK 11.18.4.

What's New in v11.18.3

Same-key consensus submissions now fail closed across every producer in the running daemon. The dashboard, REST API, federation manager, voter, and upgrade watchdog share a per-key nonce lease. Once exact transaction bytes reach CometBFT, any unproven transport, status, RPC, decode, shape, hash, or height outcome fences that signing key until reconciliation proves those same bytes committed or permanently refused. Strict shared Comet decoders require a single bounded JSON document, explicit nested verdicts, the exact transaction hash, and a positive committed height for success.

Update restart advice now follows live fence state. A completed download no longer leaves stale restart guidance behind: retained update status reads recompute whether restart is currently safe, and the dashboard renders the server-provided instructions. Coordinated restarts are refused when a fence is present. Crash, power-loss, cross-restart, and separate-process CLI exposure still require durable pre-broadcast intent and remain explicitly out of scope.

The consensus ceiling remains app-v26; v11.18.3 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.3. SDK 11.18.3.

What's New in v11.18.2

A reply to a message you sent is readable again, through an advertised MCP tool. Previously a recipient could answer, the durable row flipped to completed, and the answer was reachable only through the passive REST projection GET /v1/pipe/results — which no MCP tool ever called. sage_inbox shows work addressed to you, not answers to you, and sage_message_status is sender-only but deliberately payload-free. So in MCP and bookend clients the reply was invisible and work round-tripped. v11.18.2 adds sage_message_replies as an explicit sender-side read (SAGE now advertises 32 MCP tools) plus a payload-free pointer inside sage_inbox that reports how many replies are retained without ever presenting them as new work.

The reply read is exact-sender-only, passive, and honest about provenance. Authorization is the SQL predicate from_agent = ? against the caller's own signed identity — not the wider callerCanViewPipe rule the workflow route uses — and no parameter names another agent, so the tool cannot serve as a message-existence oracle. Reading claims nothing, acknowledges nothing, and re-queues nothing. Every body is labelled untrusted data and attributed to the agent that actually wrote it rather than the agent you addressed. GET /v1/pipe/results gains a payload-free ?count_only=1 probe and a composite (completed_at, pipe_id) before= cursor, so replies sharing a millisecond are never stranded behind the page boundary. A store backend lacking the optional capability answers 501 instead of an empty page that would read as "no replies".

Memory, agent, RBAC, federation, and consensus behavior are unchanged; app-v26 remains the binary ceiling and v11.18.2 introduces no app-v27.

Container: ghcr.io/l33tdawg/sage:11.18.2. SDK 11.18.2.

What's New in v11.18.1

MCP session guidance now uses the protocol surface intended for it. SAGE runs its per-session boot standing during initialize and returns the adaptive full, bookend, on-demand, pending-review, or unavailable guidance through initialize.instructions. The first real tool result is therefore only that tool's payload instead of being prefixed with a 1.5–2.9 KB auto-connect block. Repeated or concurrent initialization in one transport session reuses the same standing without duplicating signed registration or caller-scoped reads. Clients that skip the MCP initialization handshake keep the one-time first-tool fallback for compatibility.

Legacy-lineage recovery now represents real skip-ahead history truthfully. When retained Comet history proves a version jump such as 1→7 or 8→11, the app-v21 doctor emits a v2 transition claim at the real activation height and records the skipped predecessors as virtual, subsumed coverage. It never invents interleaved heights or writes synthetic upgrade:applied:* records. Every validator independently replays the retained history and hashes before an explicit vote, and the immutable audit is installed atomically only when app-v22 activates. Existing valid v1 receipts on already-upgraded app-v22+ chains remain readable; new v1 repair proposals fail closed.

The lineage change is confined to the exceptional app-v21 → app-v22 recovery ceremony. Memory, agent, RBAC, and federation policy are unchanged; app-v26 remains the binary ceiling and v11.18.1 introduces no app-v27.

What's New in v11.18.0

A connected pair is now the federation group users expect it to be. Each side explicitly exports the ordinary local agents it places in that pair. Every active ordinary agent on the other SAGE may then live-read those exported agents' owned domain trees by default—no matching local group, receiving domain, or linked-reader grant is required. A receiving operator can narrow that default with exact agent/domain denials. Local-only group membership is never exported transitively, and adding another federated agent is an explicit new export. Read remains borrowed; Copy still requires a source offer plus the receiver's Save here subscription, while remote memory Write remains reserved and fails closed.

Federated authorization now stays true through disclosure. The signed Read plan and single-use challenge bind the exact source-agent standing, clearance, export, agreement, policy generation, and negotiated authorization model. The source authorization lease is revalidated and held until the destination query finishes, so a concurrent rename-safe identity change, restriction, ownership change, pause, or revoke cannot leak a result. CEREBRUM and sage_federation also report authenticated-read readiness honestly, and the Docker acceptance lane proves default Read, explicit denial, non-transitive exports, bidirectional Copy backfill/incremental sync, and restart recovery.

People can address agents without giving up canonical identity. Local and federated message targets accept a unique display or immutable registered name; the resolved request and wire proof still carry only the canonical agent ID and chain. Ambiguous local/remote collisions fail with bounded immutable choices instead of selecting the first label. Federated replies now return an immutable reply_event_id, and the replier can query that exact event's delivery status without pretending it is a new inbox message.

Access Controls is now one usable control surface. Dedicated Agents, Groups, and Federation tabs use compact searchable/sortable lists and focused detail drawers instead of mounting every permission matrix at once. Modern and legacy URL deep links preserve the selected tab and exact local or federated identity. Dialog/drawer focus ownership, Escape/Tab handling, ARIA labels, and narrow-screen behavior are covered by browser-contract tests.

JOIN and upgrade recovery are bounded and explicit. A JOIN session still expires after 15 minutes, while each pasted/scanned code gets up to five minutes of Direct/relay discovery as long as its pairing screen remains open. v11.18.0 is also the first concrete release containing stopped-node backup --full, recoverable restore --from, upgrade preflight, and the app-v21 → app-v22 upgrade lineage status|doctor|verify workflow. A legacy-lineage repair is create-only, chain/current-state bound, embedded in the exact immutable upgrade proposal, never auto-voted, and requires every validator to verify and vote explicitly; an unverified anchor requires a deliberate acknowledgement.

The federation/UI work is off-consensus. The narrow lineage ceremony repairs only an eligible chain still at app-v21 before its governed app-v22 transition. Existing app-v22 through app-v26 chains are not rewritten, app-v26 remains the binary ceiling, and v11.18.0 introduces no app-v27. Both SAGEs should run v11.18.0 for the complete signed federation tuple; older peers fail closed rather than silently downgrade it.

Container: ghcr.io/l33tdawg/sage:11.18.0. SDK 11.18.0.

What's New in v11.17.15

Blank home-domain approval now does what the form promises. When an operator approves a writable pending agent without typing a home domain, CEREBRUM derives a readable slug from that agent's committed name, adds a cryptographically random suffix, and includes the resulting unowned domain in the same dual-signed approval transaction. An explicitly entered domain still wins. The unpublished v11.17.14 workflow was canceled after this browser-found regression, so v11.17.15 is the first published release containing the changes below.

Bulk domain recovery now completes on idle personal chains. CEREBRUM keeps an explicitly confirmed multi-domain transfer alive across the existing 50-block governance cooldown, shows the current/required block while consensus advances, and stops on every non-cooldown failure. Confirmed batches belong to the CEREBRUM session rather than one screen, so operators may navigate away and enqueue another transfer behind the active governance job. If an idle CometBFT clock rejects the first app-v20 authorization as too far ahead, the server re-signs the exact request once against the newly committed chain time; the proof window and every consensus authorization check remain unchanged.

Companion inbox setup now matches the profile’s purpose. Choosing the Companion/voice-bridge preset enables connected-SAGE inbox messaging by default; the independent emergency block remains available afterward. If an existing agent is blocked, Federation now keeps the warning visible and provides a one-click path to that exact agent and inbox switch in Access Controls.

v11.17.15 also contains the v11.17.13 Agents directory and Linux packaging changes below; v11.17.13 and v11.17.14 were never published after their release runs were canceled.

Included from v11.17.13

---

View the full README on GitHub