Engram 3.5.1

Frozen core source: 41f12547. Changes since the last published core release, v3.4.0: 75 merged pull requests.

This fix-forward release was published through Release run 39466387308. The existing v3.5.0 tag remains unchanged after its release attempt failed the module-tidy guard; no core v3.5.0 GitHub Release was published.

Highlights

• Atomic memory consolidation with plan/confirmation, ownership checks and structured provenance; batch relation judgments and atomic session finalization.
• Compact search, paginated observation history and Go-owned HTTP/agent workflow contracts.
• Explicit prompt sharing for Git sync: prompts are excluded from Git chunks by default.
• Local project aliases and routing previews, optional capture provenance, and explicit HOME project-selection safeguards.
• Session-owned Pi server lifecycle and bundled-store upgrade recovery; reduced compaction/bootstrap context churn.
• Fixes for sync session recreation with local children, Claude resume/compaction registration and OpenCode global-session authority.
• Windows SQLite temporary-storage stabilization; bounded enrolled-journal repair transactions; project deletion tombstones and improved diagnostics.
• Dashboard refresh and bounded dashboard read-model memory use.
• Reconciled module checksums to fix the core release tidy guard (#1957): go.sum only, 6 additions and 35 deletions; go.mod and all 95 selected module versions unchanged. Closes #1955.

Upgrade and compatibility

The authorized release pair is Engram 3.5.1 + the existing gentle-engram 0.5.0. The core source above is distinct from Pi 0.5.0's source, fe897f66e964c58284bdc83e6e5447f9ba8364c0; no Pi republishing is planned. Core and Pi version streams are independent. The companion publication guard checks registry name/version, the installer pin, startupPolicy and sessionOwned metadata; it does not require equal core/Pi SemVer or Git SHAs. That guard alone does not prove runtime compatibility.

Setup upgrades the known managed 0.4.2 predecessor while preserving unrelated settings and MCP configuration (#1924). Pi 0.5.0 is already published on npm's candidate channel and as a Pi GitHub Release; latest promotion remains separate and pending. The isolated Windows amd64 runtime and managed-settings upgrade smoke passed for both staging and the actual published core 3.5.1/Pi 0.5.0 pair. npm latest promotion remains a separate pending operation. Back up your data and configuration before upgrading. This release does not claim full Go/Pi semantic parity or validation of every downstream Shell bundle upgrade.

Verification and limits

• Actual source-fix evidence: checksum tidy RED/GREEN, module verification, unchanged selected-module comparison and independent bounded review PASS. Normal PR #1957 CI and merge-queue CI passed. The final merged core source above has parent fe897f66e964c58284bdc83e6e5447f9ba8364c0 and tree 6752db1a3f1185d24459b6aedb6ac60ad184601b, matching the reviewed checksum-fix tree. Issue #1955 is closed.
• Exact merged-source main CI 39461390767 passed for core source 41f1254796d49233d7bcb11741093bc09eb386ff; the observer exited 0. This is source-CI evidence, not validation of a new release artifact.
• Core 3.5.1 staging 39462750335 / attempt 1 succeeded for the frozen source. Artifact 12283567571 matched its API archive digest; all 14 payload files and six clean-source VCS buildinfo records were verified. The locally packed Pi 0.5.0 tarball is byte-identical to the already-published package. The staged pair's isolated Windows amd64 runtime/managed-settings upgrade smoke passed all 11 checks. Core 3.5.1 publication and actual public-asset/runtime verification succeeded within the scope below.
• Historical evidence only: the old staged core 3.5.0 and companion 0.5.0, both from fe897f66, passed an isolated Windows x64 genuine Pi 1.3.0 search/save/search smoke, authentication, managed-settings migration and owned-process shutdown checks. Pi 0.5.0 publication succeeded; its published tarball matched the staged bytes and its provenance identity was inspected (cryptographic signature-chain verification was not claimed). These results remain valid for those identities, not for new core 3.5.1 artifacts.
• Actual public assets: all seven downloaded files matched GitHub API names, sizes and SHA256 digests; the six archives also matched checksums.txt. All six executables report Go 1.25.10, the expected OS/architecture and source revision 41f12547. Public binaries differ from staging and report vcs.modified=true / +dirty; no post-build tracked-clean proof or signed-attestation equivalence is claimed.
• Actual public-pair runtime evidence: the downloaded Windows amd64 binary (SHA256 cfd90c4572428c68c702b24e990c1cd3912f977dc8bc59d678d9337520bdbc2e) and the verified public Pi 0.5.0 bytes passed all 11 checks in genuine Pi 1.3.0. Native empty search → save → search, HTTP 401/200 authentication, managed 0.4.2→0.5.0 settings migration preserving unrelated settings/MCP, and owner/child shutdown passed. The independent probe ran once and exited 0; all children and the loopback model server closed. Pi lifecycle stderr traces are expected. Coverage is Windows amd64 with synthetic private fixtures, not real-user upgrades, every platform installation or every downstream Shell bundle upgrade.
• Homebrew formula metadata was checked at version 3.5.1: all four Darwin/Linux URLs and archive hashes match this release. No Homebrew installation was performed.
• Windows binaries are not Authenticode-signed; Smart App Control and Defender reports remain separate open investigations (#1703, #1912).

Contributors

Thank you @dnlrsls, @danielgap, @MataM15, @josegarvinvictoria, @pablon, @Alan-TheGentleman, @NotMxx, @akushonkamen, @LucasOliveira-dev2026 for the contributions included in this release range. Individual PR credits and first-time contributors are listed below.

What's Changed

• fix(store): isolate manual saves from foreign session owners by @dnlrsls in #1797

• fix(hooks): make session confirmation timeout configurable by @dnlrsls in #1798

• feat(review): add data-preserving sync guidance by @dnlrsls in #1800

• fix(doctor): explain unsupported observation-source repairs by @dnlrsls in #1799

• fix(store): classify rescued session ownership atomically by @dnlrsls in #1801

• feat(sync): bound dead deferred rows with conflicts prune by @danielgap in #1783

• feat(store): add atomic ConsolidateObservations with plan/confirm (#242 slice 1 of 3) by @danielgap in #1782

• feat(store): schedule reviews for five knowledge types by @dnlrsls in #1803

• fix(plugin): bind resumed Claude sessions to their live continuation by @MataM15 in #1765

• fix(sync): exclude prompts from Git chunks unless explicitly shared by @dnlrsls in #1806

• feat(ci): add inactive linked-issue validation evaluator by @dnlrsls in #1812

• feat(pi): add canonical topic workflow to the memory protocol by @josegarvinvictoria in #1653

• feat(cli): add explicit prompt sharing for Git sync by @dnlrsls in #1813

• feat(store): preserve structured consolidation provenance (slice 2) by @dnlrsls in #1818

• feat(ci): add inactive bounded issue-check publisher by @dnlrsls in #1819

• feat(ci): bootstrap trusted issue approval refresh by @dnlrsls in #1823

• feat(store): bind consolidation to expected source owner by @dnlrsls in #1824

• docs: unify memory protocol across all agent surfaces by @pablon in #1787

• feat(mcp): expose confirmed atomic memory consolidation by @dnlrsls in #1825

• fix(pi): preserve fake CLI invocation logs on Windows by @dnlrsls in #1829

• feat(store): older history integration tracker (draft, no merge) by @dnlrsls in #1815

• feat(ci): add trusted native issue-policy PR jobs by @dnlrsls in #1838

• refactor(cli): extract doctor sync repair orchestration by @dnlrsls in #1837

• test(store): cover consolidation provenance sequences by @dnlrsls in #1836

• test(cloud): measure mutation pause lookup amplification by @dnlrsls in #1842

• feat(ci): add guarded native metadata rerun helper by @dnlrsls in #1843

• feat(mcp): add batch judgments and atomic session finalization by @dnlrsls in #1840

• test(cloudstore): characterize dashboard cache read behavior by @dnlrsls in #1848

• test(cloudstore): measure dashboard rebuild SQL and history cost by @dnlrsls in #1849

• feat(ci): prepare inactive issue approval refresh dispatcher by @dnlrsls in #1850

• fix(store): adopt the coupled SQLite libc EINTR sleep fix by @dnlrsls in #1853

• fix: recover bundled stores across core upgrades and stop session-owned servers with Pi by @Alan-TheGentleman in #1854

• feat(contract): add Go-owned agent contract foundation by @dnlrsls in #1847

• test(scripts): cover operational performance ratchet modes by @NotMxx in #1784

• feat(ci): wire issue approval events to guarded native refresh by @dnlrsls in #1855

• fix(ci): bind native refresh to the original PR event by @dnlrsls in #1861

• fix(pi): preserve owned startup fixture checks on Windows by @dnlrsls in #1862

• feat(search): expose compact search through HTTP and Pi by @dnlrsls in #1863

• ci(governance): enforce root-cause-first contribution lifecycle by @dnlrsls in #1295

• feat(history): expose paginated observation history through HTTP and Pi by @dnlrsls in #1869

• test(ci): cover duplicate runs and late legacy publication by @dnlrsls in #1867

• feat(release): add rejection-only candidate checker by @dnlrsls in #1874

• refactor(agent): share compound workflow validation across transports by @dnlrsls in #1871

• feat(release): validate local Pi package tarballs by @dnlrsls in #1882

• feat(http): integrate Go-owned agent workflows on main by @dnlrsls in #1883

• fix(pi): integrate Go-owned agent profile on main by @dnlrsls in #1884

• test(pi): integrate real HTTP workflow coverage on main by @dnlrsls in #1886

• feat(capture): preserve optional project provenance by @dnlrsls in #1885

• fix(ci): validate trusted qualified issue references by @dnlrsls in #1887

• feat(server): integrate current HTTP runtime endpoint on main by @dnlrsls in #1889

• feat(projects): add local aliases and routing preview by @dnlrsls in #1890

• feat(runtime-contract): generate current Go-owned HTTP projection by @dnlrsls in #1893

• fix(sync): isolate inbox retention and read-only state by @dnlrsls in #1898

• feat(pi): package Go runtime comparison assets by @dnlrsls in #1904

• fix(doctor): skip blank MCP registration configs by @dnlrsls in #1915

• docs(contributing): map existing focused verification commands by @dnlrsls in #1916

• fix(store): bound enrolled journal repair transactions by @dnlrsls in #1917

• fix(store): record project tombstone on delete project --hard by @akushonkamen in #1895

• test(store): make project tombstone timestamp coverage deterministic by @dnlrsls in #1918

• fix(doctor): warn on inert foreign sync targets by @dnlrsls in #1919

• feat(project): prepare opt-in HOME project selection guard by @dnlrsls in #1922

• fix(project): require explicit HOME selection at capture boundaries by @dnlrsls in #1925

• fix(cloudstore): bound dashboard read-model build memory by @Alan-TheGentleman in #1931

• feat(cloud): re-theme the dashboard with the gentlemanprogramming.com styles by @Alan-TheGentleman in #1933

• feat(release): guard companion publication order by @dnlrsls in #1936

• feat(release): stage unsigned candidates without publication by @dnlrsls in #1939

• fix(claude): avoid redundant bootstrap context retrieval by @dnlrsls in #1945

• fix(pi): keep compaction recovery out of the system prompt by @dnlrsls in #1946

• fix(pi): isolate native contract fixtures from delegated roles by @dnlrsls in #1950

• fix(opencode): validate global session location authority by @dnlrsls in #1952

• fix(sync): preserve local data across chunk session recreation by @dnlrsls in #1951

• fix(claude): register a resumable session after compaction by @LucasOliveira-dev2026 in #1935

• fix(cli): stabilize SQLite temporary storage on Windows by @dnlrsls in #1953

• feat(release): prepare compatible session-owned candidate pair by @dnlrsls in #1924

• fix(build): reconcile module checksums for core release by @dnlrsls in #1957

New Contributors

• @MataM15 made their first contribution in #1765
• @pablon made their first contribution in #1787
• @NotMxx made their first contribution in #1784
• @akushonkamen made their first contribution in #1895
• @LucasOliveira-dev2026 made their first contribution in #1935

Full Changelog: v3.4.0...v3.5.1