Repository navigation
release: v0.1.0 prep — bump, CHANGELOG, SECURITY.md, agent-memory-mcp rename, crates.io workflow - #18
Merged
Merged
Conversation
25 threats from the 05-01..05-05 plan-time registers: 20 mitigated (verified at ASVS L1 grep depth), 5 accepted with rationale. threats_open: 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner decision on issue #7 (2026-10-25): v0.1.0 ships from main, including Phase 5 export/import, on the six targets release.yml already builds. DIST-03 (Windows) and DIST-05 (musl as a hard target) move to v0.2.0; the musl legs stay best-effort. Phase 6 now maps DIST-06 only, widened to cover the crates.io publish (#9) and CHANGELOG/SECURITY.md (#8). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- agent-memory and agent-memory-core 0.0.1 -> 0.1.0 - cargo update -p chacha20: 0.10.1 (yanked) -> 0.10.2 - CHANGELOG.md (Keep a Changelog) from git log v0.0.1..main: update, relations, hybrid search, JSONL export/import, error redaction - SECURITY.md: GitHub private vulnerability reporting; scope is the local binary, REST is unauthenticated and loopback-only by design Refs #8, #2 (not closed here). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#9) - [package] name agent-memory -> agent-memory-mcp; [[bin]] stays agent-memory, so the executable, tarballs and Homebrew are unchanged - version = "0.1.0" on the agent-memory-core path dep and dev-dep - readme, keywords, categories on both crates - README: visible mcp-name line for the MCP Registry, install from crates.io section - CHANGELOG: rename entry Packaging dry-run green: cargo package --workspace --locked (core verified, then mcp verified against core from a temp local registry). Refs #9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New .github/workflows/publish-crates.yml, separate from release.yml: - same exact vX.Y.Z tag filter; GitHub-hosted (public repo, no self-hosted label can run here) - job permissions contents: read + id-token: write; no org secret, the token comes from rust-lang/crates-io-auth-action (OIDC) - checks the tag against both crate versions, runs the tests, then publishes agent-memory-core, waits for the index, then agent-memory-mcp - idempotent: a crate whose version is already in the crates.io sparse index is skipped (the first publish of each crate is manual); only a 404 counts as absent, any other lookup failure stops the run - every action pinned to a full commit SHA with a version comment Refs #9. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
release.yml and spike-cross-compile.yml selected the package with -p agent-memory, which no longer exists after the rename, so the v0.1.0 tag run would have failed at the build step. Both now use -p agent-memory-mcp. The [[bin]] is still agent-memory, so the binary path, the agent-memory-<triple>.tar.gz assets and the Homebrew formula are unchanged. The release notes gain a cargo install section, and the runner-policy comment points at publish-crates.yml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
initialize reported the SDK identity (rmcp 1.8.0); it now reports agent-memory with the package version, a display title and the repository URL, pinned by a stdio handshake test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dates the 0.1.0 heading and adds a Fixed entry for the serverInfo identity. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…0 CHANGELOG entry Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #7. Covers the pre-tag work of #8 and #9; those issues stay open until the tag and the crates.io publish land.
What changes
chacha20moves from 0.10.1, which was yanked, to 0.10.2.CHANGELOG.md(Keep a Changelog, dated 2026-10-25) andSECURITY.md, which points to private vulnerability reporting. That reporting is now enabled on the repo.agent-memory-mcp, becauseagent-memoryis taken on crates.io. The executable is stillagent-memory, and the release tarball names and the Homebrew formula are unchanged. Both crates gain crates.io metadata, the core dependency now carriesversion = "0.1.0", and the README gets the visiblemcp-name: io.github.UnityInFlow/agent-memoryline and acargo install agent-memory-mcpsection.release.yml/spike-cross-compile.yml: both now build-p agent-memory-mcp. Without this change the v0.1.0 tag run would have failed at the build step.publish-crates.yml:vX.Y.Ztags, on a GitHub-hosted runner, withcontents: readandid-token: write.serverInfo:initializenow reports{"name":"agent-memory","title":"Agent Memory","version":"0.1.0","websiteUrl":…}. Before, it reported rmcp's own{"name":"rmcp","version":"1.8.0"}. A test checks this.05-SECURITY.mdrecords the Phase 5 security audit (25 threats: 20 mitigated, 5 accepted, 0 open). Phase 6 of the roadmap is re-scoped to the v0.1.0 release; Windows binaries and a required musl build move to v0.2.0, per the owner's decision on Launch v0.1.0: release, rename crate, directories (2026-10-24 plan) #7.Verification (local, at the PR head)
cargo fmt --all -- --check: cleancargo clippy --workspace --all-targets --locked -- -D warnings: cleancargo test --workspace --locked: 288 passed, 0 failed, 2 ignoredcargo package --workspace --lockedsucceeds on a clean tree. The binary crate was verified against the unpublished core.publish-crates.ymlunwrap()added to production code; no new dependenciesAfter merge (owner steps, in order)
agent-memory-core, thenagent-memory-mcp.UnityInFlow/agent-memory, workflowpublish-crates.yml).v0.1.0on the same commit.🤖 Generated with Claude Code