v3.19.0 — memory hygiene + scoring integrity

• release: v3.19.0 — sync pyproject + release notes to the manifest
• docs(readme): complete rewrite — kill the stale changelog and the wiki triplication
• docs(readme): execute the staged revision plan — coherent benchmark story, all cells labelled
• bench(paper1): paired oracle-vs-temporal reproduction on current code — temporal advantage persists
• docs(outreach): refresh verifiable facts — page counts 34/39, stars 52, 196 Qs
• feat(bench): record provenance in decay sweep artefacts + tighten paper2 mechanism phrase
• docs(paper1): fix BEAM-10M provenance — 0.471 is temporal label-free, 0.429 is oracle
• docs(paper2): re-scope decay thesis — dirty-DB confound falsified the dose-response
• bench(papers): overnight compute results + assembly findings
• docs(paper2): pre-submission fixes — BEAM metric honesty, decay dose-response as thesis
• docs(paper1): pre-submission fixes — metric honesty, data errors, rigor
• revert(hooks): doctor is a personal ~/.claude hook, not a plugin feature
• fix(doctor): never delete by default — the hook ships to every user
• feat(hooks): .claude hygiene doctor — session-start invariant checks
• fix(viz): Memories HUD stat = in-galaxy rendered count, store total on hover
• feat(memory): tier-aware read/storage — close gaps C1–C4 of the §8b two-tier model
• fix(viz): a held SSE stream is a live client — never idle-shutdown under it
• style: ruff format on bounded-io/viz session files (CI format gate)
• release: 3.19.0 — scoring integrity, gist+pointer hygiene, governors, galaxy restoration, test-DB guard
• fix(tests): refuse destructive isolation against a populated database
• perf(viz): auto-load galaxy through L5; defer L6 AST symbols to demand
• fix(viz): galaxy build kick + phase loader — the GRAPH tab can render again
• fix(viz): purge dead ~/Documents/Developments paths — comments and fallbacks
• fix(viz): point automatised-pipeline dev-binary fallback at real clone path
• fix(viz): restore GRAPH galaxy tab alongside TRACE + true memory count
• feat(bounded-io): Phase 4 — close sharded-popping-harbor C3 + C6
• docs(bounded-io): Phase 3 closed — record commits, premise corrections, gates
• feat(bounded-io): Phase 3 — bound the upstream MCP connection pool
• feat(bounded-io): Phase 2 — write-side hygiene + scoring-inversion fix
• docs(bounded-io): record Phase 1 follow-up commits 967545d + e43f41a
• feat(bounded-io): priority-weighted response budgets at every read boundary
• test(invariants): I2 heat-writer line drift 292->317 after homeostatic slim-projection helpers
• fix(bounded-io): Phase 0 — kill response duplication + uncapped table scans
• refactor(mcp): rename ai-architect MCP refs to automatised-pipeline
• fix(ingest): stop ConnectionResetError when child dies mid-Cypher-fetch

Full Changelog: v3.18.4...v3.19.0

v3.18.4

• fix(graph): use _node_order length for bounded-discard cursor
• fix(setup): per-user DATABASE_URL config + three-way DB diagnostics (#58)
• fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) (#57)
• chore(deps): bump the uv group across 1 directory with 2 updates (#56)
• refactor(ingestion): prune vendored dirs in source walk (no rglob descent) (#55)
• feat(marketplace): list zetetic-team-subagents alongside cortex (#54)
• fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers (#53)
• Release 3.18.4
• fix(ingest): stop writing symbol memory rows — entities only, cap at 50k symbols
• fix(ci): catch LocalEntryNotFoundError for HF cache miss on newer huggingface_hub
• fix(ci): ruff format the repo green + exclude transient agent worktrees
• release(3.18.4): progressive graph build, any-file git diff/AST, self-healing AP bridge
• fix(ap): self-healing MCP bridge — kill the handshake flakiness root causes
• fix(viz+sec): legend counts rendered graph; CodeQL path-injection sanitisers; drop dead lod.js
• fix(ingest): prune precedent code-graphs on re-index ("update a version → remove the precedent")
• fix(viz): legend counts the RENDERED graph, not server meta (fixes 0-discussions + mismatch)
• fix(viz): AP impact diagram — normalize absolute paths to AP's repo-relative File.id
• fix(viz): progressive graph build — bounded memory, keyset streaming, no migration storm

What's Changed

• fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers by @cdeust in #53
• feat(marketplace): list zetetic-team-subagents alongside cortex by @cdeust in #54
• refactor(ingestion): prune vendored dirs in source walk (no rglob descent) by @cdeust in #55
• chore(deps): bump the uv group across 1 directory with 2 updates by @dependabot[bot] in #56
• fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) by @cdeust in #57
• fix(setup): per-user DATABASE_URL config + three-way DB diagnostics by @cdeust in #58

Full Changelog: v3.18.3...v3.18.4

v3.18.3

• fix(pipeline): resolve AP from the marketplace install, not a self-built symlink
• release(3.18.3): freshness self-heal + commit-reindex + cross-lens doc graph
• fix(ingest): self-healing graph memo + commit-triggered re-analyze
• fix(wiki-graph): union PG + FS page sources (not either/or)
• fix(wiki-graph): derive wiki_link edges from page bodies + correct code-page path
• feat(viz): cross-lens documentation graph (WIKI lens)

Full Changelog: v3.18.2...v3.18.3

v3.18.2

• release(3.18.2): ship the ingest_prd PRD-consumption fix
• fix(ingest_prd): use prd-gen correctly + pull quality history

Full Changelog: v3.18.1...v3.18.2

v3.18.1

• refactor(viz): use AP typed tools (get_context/get_impact) + bump 3.18.1
• fix(ap_bridge): resolve AP MCP via installed_plugins.json, not bin/* glob
• fix(viz): HUD shows true store counts, not loaded-graph nodes

Full Changelog: v3.18.0...v3.18.1

v3.18.0

• fix(security): escape quotes in HTML attrs + mark node-id hash non-security
• feat(viz): surface AP all-file edges — doc References + File→File imports
• style(viz): ruff format _git_versions + impact rollup (CI lint)
• feat(viz): full AP direction/versioning/causal in trace + bump 3.18.0
• fix(test): I2 heat_base allow-list line numbers after viz merge
• feat(viz): galaxy-style cluster separation + type-banded session disks
• fix(lint): ruff format + remove dead locals/imports in viz files
• Merge remote-tracking branch 'origin/main' into viz-to-main
• feat(viz): live execution-trace graph — domain→session→chain, impact diagram, unified panel
• feat(viz): server-side streaming pipeline for the graph data layer
• Merge remote-tracking branch 'origin/main'
• fix: silent-truncation zips in paper-critical paths + dangling asyncio task
• fix(pg_store): atexit-close pool — stops hook process leak (~3-6 conn/leak)
• ci(pypi): restore PyPI publish into release.yml as a deprecated channel
• fix(viz): page the phase endpoint — default loader no longer dies on L5
• tune(zera): chunk at 60K items (~100 MB/chunk) for V8 headroom
• feat(zera): chunked payload frames — defeat the V8 max-string-length wall
• fix(viz): phase-buffer race (L5 truncated JSON) + quadtree ERR_EMPTY_RESPONSE
• fix(zera): TypeError on live graph (non-JSON values) + on-demand zstd level
• fix(viz): ZERA endpoint shipped empty bundle + wire JS decoder into viz
• feat(viz): /api/graph.zera — ZERA bundle transport for the neural graph
• fix(viz): race in /api/graph — Content-Length set, body truncated/empty

What's Changed

• feat(viz): server-side streaming pipeline for the graph data layer by @cdeust in #50

Full Changelog: v3.17.2...v3.18.0

v3.17.2 — Security distribution fix (GHSA-gvpp-v77h-5w8g)

• release(3.17.2): advertise the GHSA-gvpp-v77h-5w8g fix to the marketplace

Full Changelog: v3.17.1...v3.17.2

v3.17.1 — Security: GHSA-gvpp-v77h-5w8g (untrusted dev-source ACE)

• fix(security): GHSA-gvpp-v77h-5w8g — untrusted dev-source ACE (#47)
• test: add pytest-timeout to surface hanging tests in CI
• style: ruff format on graph_quality_scorer.py + test_recall.py
• fix(recall): align handler output with declared outputSchema (#46)
• fix(graph_quality_scorer): BUG #6 — score AST-derived SYMBOL nodes
• fix(mcp): remember tool output validation — schema vs handler mismatches (#45)
• chore(deps): bump idna in the uv group across 1 directory (#44)
• fix(ci): resolve 3 remaining test failures from the wiki autonomy turn
• docs(svg): fix architecture diagram layout bugs
• docs: refresh architecture + team-memory SVGs for 3.17.0
• feat(wiki): port full 42-scope catalogue from agentic-ai for parity
• docs(README): rewrite "Write papers in Cortex" with the new editor screenshot
• feat(wiki): expand guides catalogue to 27 canonical scopes
• feat(wiki): add installation / troubleshooting / contributing how-to scopes
• feat(wiki): add flow-diagram canonical section (parity with agentic-ai)
• docs(README): wire two real wiki screenshots into the wiki section
• release: v3.17.0 — autonomous wiki curation
• style: ruff check — remove unused imports + local variable
• style: ruff format pass + test_auto_curator scope lookup by name
• feat(wiki): autonomous curation loop with per-project coverage
• fix(domain): discover repos under ~/Documents/Developments too
• feat(curate_wiki): wire skip-authored + consolidate stats + SessionStart preamble
• feat(curate_wiki): auto-curator that produces wiki-authoring jobs from PG memory clusters
• fix(seed): refuse transient roots (worktrees, pytest fixtures, deps/)
• feat(viz/wiki): render mermaid diagrams in wiki pages
• fix(wiki): skip empty Process pages (symbol_count=0) — they have no information
• fix(wiki): block codebase-scan dumps from polluting wiki notes
• fix(wiki): block auto-captured tool dumps from becoming wiki pages
• fix(wiki): render Bash stdout/stderr + Edit diffs as readable multi-line markdown
• fix(wiki): no truncation in auto-capture + strip markdown from page titles
• fix(viz): never block MCP launch or UI load — graph builds only on Graph button click
• fix(recall): filter low-signal tool-output captures from default results (#43)
• fix(wiki): bulk_migrate robustness fixes from live apply (ADR-2244 Phase 4.1) (#42)

What's Changed

• fix(wiki): bulk_migrate robustness fixes from live apply (ADR-2244 Phase 4.1) by @cdeust in #42
• fix(recall): filter low-signal tool-output captures from default results by @cdeust in #43
• chore(deps): bump idna from 3.12 to 3.15 in the uv group across 1 directory by @dependabot[bot] in #44
• fix(mcp): remember tool output validation — schema vs handler mismatches by @cdeust in #45
• fix(security): GHSA-gvpp-v77h-5w8g — untrusted dev-source ACE by @cdeust in #47

Full Changelog: v3.16.0...v3.17.1

v3.16.0

• release: v3.16.0 — ADR-2244 Phases 2-6.2 (wiki classification redesign complete) (#41)
• fix(wiki): seed-codebase emits modern kind tags the classifier reads (ADR-2244 Phase 6.2) (#40)
• feat(wiki): filter auto-generated pages from default views (ADR-2244 Phase 5) (#39)
• feat(wiki): re-bucket 8734 file-doc notes to reference/ (ADR-2244 Phase 4.2) (#37)
• fix(wiki): route codebase_analyze output to kind=reference (ADR-2244 Phase 6) (#38)
• feat(wiki): Phases 3.2 + 4.1 — handler-layer redirects + bulk migration onto main (#36)
• feat(wiki): stable page IDs + redirect stubs (ADR-2244 Phase 3 foundation) (#33)
• docs(wiki): verify Phase 2 pilot on 1000-page sample (96.7% kept) (#32)
• feat(wiki): ADR-2244 Phase 2 — pilot migration analyzer + first 100-page report (#31)
• fix(deps): bump authlib 1.7.0 → 1.7.2 (CVE-2026-44681 / GHSA-r95x-qfjj-fjj2) (#30)
• release: v3.15.4 — ADR-2244 wiki classification redesign (#29)
• refactor(wiki): replace closed enums with data-driven axis registry (#28)
• feat(wiki): richer multi-axis classification (ADR-2244 Phase 1) (#27)
• fix(wiki): plug slug/title leaks producing .md.md, timestamp-slugs, path-titles (#26)
• fix(codebase_analyze): default to no file cap, treat max_files<=0 as unbounded (#25)
• chore(deps): bump urllib3 in the uv group across 1 directory (#24)

What's Changed

• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in the uv group across 1 directory by @dependabot[bot] in #24
• fix(codebase_analyze): default to no file cap, treat max_files<=0 as unbounded by @cdeust in #25
• fix(wiki): plug slug/title leaks producing .md.md, timestamp-slugs, path-titles by @cdeust in #26
• feat(wiki): richer multi-axis classification (ADR-2244 Phase 1) by @cdeust in #27
• refactor(wiki): replace closed enums with data-driven axis registry by @cdeust in #28
• release: v3.15.4 — ADR-2244 wiki classification redesign by @cdeust in #29
• fix(deps): bump authlib 1.7.0 → 1.7.2 (CVE-2026-44681 / GHSA-r95x-qfjj-fjj2) by @cdeust in #30
• feat(wiki): ADR-2244 Phase 2 — pilot migration analyzer + first 100-page report by @cdeust in #31
• docs(wiki): verify Phase 2 pilot on 1000-page sample (96.7% kept — passes ADR-2244 target) by @cdeust in #32
• feat(wiki): stable page IDs + redirect stubs (ADR-2244 Phase 3 foundation) by @cdeust in #33
• feat(wiki): Phases 3.2 + 4.1 — handler-layer redirects + bulk migration onto main by @cdeust in #36
• fix(wiki): route codebase_analyze output to kind=reference (ADR-2244 Phase 6) by @cdeust in #38
• feat(wiki): re-bucket 8734 file-doc notes to reference/ (ADR-2244 Phase 4.2) by @cdeust in #37
• feat(wiki): filter auto-generated pages from default views (ADR-2244 Phase 5) by @cdeust in #39
• fix(wiki): seed-codebase emits modern kind tags the classifier reads (ADR-2244 Phase 6.2) by @cdeust in #40
• release: v3.16.0 — ADR-2244 Phases 2-6.2 (wiki classification redesign complete) by @cdeust in #41

New Contributors

• @dependabot[bot] made their first contribution in #24

Full Changelog: v3.15.3...v3.16.0

v3.15.3 — security hotfix (python-multipart CVE)

• fix: v3.15.3 hotfix — python-multipart CVE + recover from broken v3.15.2 tag (#23)
• fix(mcp): ${CLAUDE_PLUGIN_ROOT} substitution + cortex-doctor mcp diagnostic (#22)

What's Changed

• fix(mcp): ${CLAUDE_PLUGIN_ROOT} substitution + cortex-doctor mcp diagnostic by @cdeust in #22
• fix: v3.15.3 hotfix — python-multipart CVE + recover from broken v3.15.2 tag by @cdeust in #23

New Contributors

• @cdeust made their first contribution in #22

Full Changelog: v3.15.2...v3.15.3