Changelog

The exposed native workspace select is replaced by the mockup-aligned two-line trigger, workspace icon, animated chevron, active checkmark, and bounded menu explanation on desktop and mobile.

Selecting an authorized workspace still clears stale results and scopes Memories and Workspace Graph requests with the same live workspace_id.

Workspace names and selection state are cleared when the principal signs out or the adapter disconnects; no workspace or credential state enters browser storage.

The Astro operator dashboard now implements the complete fifteen-destination product map from the approved Level 6 mockup: Atlas, Memories, Context, Subjects, Work, Audit & Events, System, Models, Federation, Access, API & Keys, Projects, Approvals, Releases, and Profile.

Atlas adds a bounded workspace_graph lens over authorized claim/subject nodes and canonical relationships, with stable layout, selection, legend, truncation state, and direct Evidence Trace navigation.

New principal, project, subject, reference, scoped-grant, access-simulation, and masked model-diagnostic routes run through the shared Bun/Cloudflare contract. Model probes are bounded, rate-limited, metadata-audited, and make no canonical write.

Work, grant/key management, approval, and release controls now execute their existing versioned server operations with confirmation and refreshed live state. Context shows its token budget; System shows readiness detail.

Canonical reads, writes, approvals, events, Atlas, context, federation, and directories now share a visibility-plus-additive-grant boundary. Derived API keys are clamped to their declared target and their issuer’s current grants on every request; admin delegation remains bounded to its grant target.

Memories and Workspace Graph keep organization-visible records available in every selected workspace while limiting team-visible records to the matching workspace.

Dashboard navigation, responsive rail, local typography, loading/empty/error states, search, pagination, and action surfaces now match the approved warm-paper desktop and 320 px mobile system without new runtime dependencies.

The npm package includes dist/index.html, so an installed titen dashboard serves the root redirect as well as /dashboard/ (#303).

Atlas fallback routing remains in the shared API root, preserving the authenticated Cloudflare administrator compile path (#304).

Migration 23 backfills compatibility grants without rewriting evidence; denied resources remain absent from labels, counts, facets, cursors, graph topology, disputes, citations, and directory summaries.

Model configuration exposes only masked immutable tuples; dashboard secrets, provider payloads, prompts, and embeddings never enter browser-visible state.

Authorized context and active release nodes beside source observations and the focus claim.

Evidence Trace now uses a centered claim, deterministic graph layout, and labeled supports, contradicts, qualifies, selected-in, and released-as edges.

Context packs fail closed when any item is unreadable, while releases are revalidated against the current active claim version and validity window.

GET /v1/memories lists authorized canonical claims with bounded lexical search, lifecycle/visibility filters, and stable keyset pagination.

The same-origin dashboard adapter exposes the protected Memories list route.

Memories has real loading, empty, error, search, and pagination states; a selected record opens its evidence graph in Atlas.

Atlas is a separate navigation destination with its graph, inspector, compile trace, and administrator boundary.

Global dashboard search now searches Memories.

Memory list authorization and retention checks run in canonical SQL before FTS or pagination. Hidden records never contribute to a count or cursor.

Audited organization-admin Memory Atlas mode for owner/root operators with bounded reasons and metadata-only audit records.

Explicit principal/access metadata and safe empty-state copy in the dashboard.

Pending semantic-index projections now report HTTP 200 readiness with index_projection_pending; dependency failures remain HTTP 503.

Dual-runtime contract, security, dashboard, and package smoke coverage now protects both paths.

Organization-wide reads require the dedicated scope, owner/root role, same-organization binding, bounded reason, retention filtering, and limit enforcement.

Audit records never contain memory content.

titen dashboard [--port 4322] serves the packaged Astro dashboard through the existing same-origin adapter. Live mode remains opt-in and requires the documented private service configuration.

prepack rebuilds the dashboard and SDK before creating the npm tarball.

The package includes only built dashboard assets and the adapter entrypoint; credentials, mockup source, memory content, and runtime state remain excluded.

Reworked the Astro dashboard rail, header, lens controls, status metadata, topology workspace, compile trace, and inspector with local Titen icons and the approved warm paper palette.

Added a live, bounded SVG topology that is derived only from authorized Atlas nodes and edges, with a synchronized accessible record list and inspector.

Added a native search dialog that fills the authorized Atlas query without moving credentials or memory data into browser storage.

Wired every visible rail item to a real destination: Memories aliases Atlas, System shows live health/readiness, Access shows the effective principal policy, and Releases loads authorized release data.

Added a private Profile view with session-backed password rotation, and fixed the readiness revision display when the upstream reports it in response metadata.

Dashboard mobile layout now keeps the Atlas graph inside an internal scroll region and preserves a single-column reading path.

A bridge started without its environment answered every lookup from the wrong store and said so nowhere. With neither TITEN_MCP_URL nor TITEN_API_KEY set, titen mcp falls back to ~/.titen/memory.db. That is correct, and a host configuration can reach it by accident: on the machine where this was found, a project-scoped MCP registration with an empty env shadowed the user-scoped one that carried both variables. The session looked healthy — connected, eighteen tools — while titen_compile returned zero items for a subject whose claim the served instance returned over HTTP in the same minute. Local mode now names the store it opened and both unset variables twice: once on stderr, and once appended to the instructions in the initialize result, which is the copy the model reading an empty context pack can actually see. A served deployment appends nothing.

A failed bridged request was one sentence for every cause. A revoked key, a wrong port and a restarted server all produced exit 0, empty stderr, and the same -32000 Titen MCP request failed.; a notification produced no reply and no trace at all. The endpoint and the caught reason now go to stderr for requests and notifications alike, with the API key redacted as it already was in a response body, and an upstream answer that is not JSON-RPC reports its HTTP status. The body is still never printed, because it carries memory.

.gitignore covered databases and no key material. titen.key, keys/owner.key and secrets/x.pem were all committable in the repository whose CLI prints an API key and a dashboard password, and whose default --db is relative to the working directory. *.key, *.pem, *.p12 and secrets/ are now ignored.

Switching from @modelcontextprotocol/server-memory imported nothing, and said nothing. That server writes beside its own module when MEMORY_FILE_PATH is unset, so anyone who ran it the documented way has their graph in a hashed directory inside npm’s _npx cache — never searched. An MCP server launched by a desktop client also inherits the client’s working directory, so the one fallback was weakest exactly where it was relied on. Both populations imported zero entities in silence, which reads as Titen losing their memories. The search now covers the working directory, node_modules/@modelcontextprotocol/server-memory/dist beneath it, and every such install in the _npx cache, under both memory.jsonl and the older memory.json.

memory://knowledge-graph is served. resources/list returned -32601, so a client reading the graph as an MCP resource broke on the switch however well the nine tool names matched. initialize declares resources with subscribe: false: readable, no change notifications.

Every authenticated request paid a durable write to record that it had read. Measured on WAL with synchronous = FULL: fifty no-op CASE updates grow the WAL by 0 bytes, fifty real ones by 206,032 — one page and one fsync each, one billed write on D1. 25 of 27 GET routes paid it. Now bounded to one write per key per minute, still monotonic.

An imported credential colliding with another organization told the operator to retry forever — advice that can never succeed, because the collision is with another organization’s row rather than a concurrent write.

score is comparable across queries (#227). Relevance was rescaled against the candidate set, pinning the best candidate to exactly 1 however poor the match, so rank 1 returned one distinct value across all 500 benchmark questions and threshold-based abstention was arithmetically impossible. It is now strength / (strength + 3.7) where strength is the bm25 magnitude per query term; rank 1 now returns 498 distinct values spanning 0.4875–0.6632. Pre-registered before any cell was scored: anchor recall@1 0.8800 → 0.8800, pooled 0.2460 → 0.2460, sign tests W0/L0/T500 at p = 1.0, compile p95 +1.21% / +0.67%.

That safety gate could not have failed, and the report says so. Both benchmark stores were ingested in one pass, so all five non-relevance components are constant across 89,467 packed items — with those constant the ordering is identical by arithmetic, making the unchanged recall a derivation rather than a finding. Where they vary the behaviour does change: at bm25 −60 against −45 the relevance gap compresses 0.250 → 0.018 and the order flips to the verified claim over the marginally better-matching asserted one. Intended, pinned by contract, and bounded — a genuinely weak match still loses to a strong one however trusted.

Two limits, stated rather than left to be discovered. 3.7 is calibrated on LongMemEval-S and BM25 is not portable across corpora, so the absolute band shifts with the corpus while the ordering does not. The vector arm’s half of the change is unmeasured: both benchmark lanes ran with vectors disabled.

Five exports that shipped in the tarball with no caller anywhere in the source, tests, scripts or dashboard: ftsQuery, canReadRecord, recordEvent, param, FEEDBACK_ENDPOINT.

No API change and no migration. Anyone on 0.7.2 who switched from @modelcontextprotocol/server-memory and saw an empty store should restart titen mcp: the import runs on a store that has not yet imported, and it now looks where that server actually writes.

@types/node and @types/bun were never installed, so tsc could not resolve process, Bun, or any node:/bun: import — 791 reported errors, none of them bugs. src/ is now clean under tsc --noEmit with no any, @ts-ignore, or new cast added.

titen-memory@0.7.1 cannot serve a large single-subject store: one context compile takes a median 74.5 seconds where 0.7.0 takes under half a second. The 0.7.1 fix for #291 wrote the disputed predicate as a join inside EXISTS while its own comment claimed the nested form, and a join inside EXISTS is still a join the planner may reorder. SQLite 3.53.0 — the version Bun 1.3.14 links — reorders it to SEARCH o USING INDEX observations_workspace_scope (org_id=?), scanning every observation in the organization once per candidate row: the exact shape src/core/authorization.ts documents as the historical 79-second failure, shipped in the release that believed it had prevented it.

Who is affected: anyone whose store holds many claims under one subject and who compiles with a large max_candidates. The cost is the product of candidates and organization-wide observations, so small and per-subject stores are unaffected — which is why no test and no published benchmark caught it. Every published pooled quality figure was measured on 0.7.0; every published pooled or scoped-anchor latency figure was measured on 0.7.0 or on this release, never on 0.7.1.

Measured, 342,129-claim / 19,829-observation store, one subject, real statement, EXPLAIN captured from bun:sqlite rather than a pasted copy:

	candidate query	served compile
0.7.1 as published	73,439 ms	74,474 ms
this release	232 ms	417 ms p50 / 864 ms p95

This restores 0.7.0’s behaviour; it does not make compile fast. 864 ms p95 still fails the pre-registered 250 ms gate, so the 2026-08-07 latency falsifier stands — the pre-registration predicted exactly that outcome in writing before the run.

The ranked output is byte-identical to the published 0.7.0 pooled run — equal sha256 over all 500 instances — so this restores the shipped answer rather than changing it. Full method and both plans in the report, protocol pre-registered before the A/B.

Plan-shape guards for the retrieval queries (tests/integration/query-plan.test.ts). The regression above was invisible to every existing test because contract stores hold tens of rows and still return the right answer quickly. The load-bearing discovery is that the bad plan reproduces on an empty store — SQLite picks the join order from the schema, not from row counts — so a cheap deterministic test could have caught this and the 2026-08-07 occurrence before either shipped. The guards assert the plan of the candidate query, the by-id hydration, and authorized-source loading; reverting the fix fails two of the three. They assert the plan, never a duration: a timing assertion on this hardware would be flaky, and the plan is what regressed.

The pooled-store measurement: quality, latency, and build cost at production store shape. All 19,829 distinct LongMemEval-S sessions in one single-subject store, all 500 questions against it, at four store sizes — the condition every published number in this field (ours included) avoids by giving each question its own ~50-session haystack. Pre-registered with five falsifiers before the first scored run (prereg, report). The system under test is the published npm tarball, not a checkout.

The 2026-08-07 agent-memory landscape survey, superseding 2026-08-04 on the fame roster and correcting two of its claims, and the performance-axis answer recording which competitive axes were adversarially killed and why.

A ranking dead heat now breaks on authorized evidence depth before the arbitrary statement fallback (#288). Order changes only where weighted score and vector similarity are both exactly tied; measured byte-identical on all 500 LongMemEval-S instances, and published as capturing 0.0 of the reranking ceiling on that corpus (report).

The disputed signal now resolves through the caller’s own authorization, so a contradicting observation the caller may not read no longer marks the claim (#291). The flag was computed from a bare EXISTS over claim_sources with no join to observations, while the citations beside it were filtered correctly. A principal who could not read the contradicting source still saw the claim demoted by the 0.05 conflict term and still received a conflicts[] entry whose evidence_ids omitted the source that caused it — told a contradiction existed and told they could not see it. Fixed at all four query sites: POST /v1/context/compile (lexical and vector candidates), GET /v1/context/:id, and the Memory Atlas conflict_freshness lens. The governance review queue was already correct and now shares the same predicate.

Visible consequence: in a store that already holds a cross-scope contradiction, claims that were demoted for callers who cannot read the contradicting source stop being demoted. Their score rises by up to 0.05, their score_components.conflict reads 1 instead of 0, they leave conflicts[], and the resulting order can change. Nothing changes for a caller who can read the source, and nothing changes for a claim whose own status is disputed — that is the claim’s own field, not an inference about hidden evidence. There is no migration and no flag: the previous numbers were the leak.

Response shapes, routes, and field names are unchanged, so this is a patch under the table in release.md — the minor slot signals shape breakage, and only values that were disclosing hidden rows move here.

The Memory Atlas review queue no longer scans every observation in the organization to decide has_contradiction. It expressed the predicate as claim_sources JOIN observations, and SQLite drove from observations, evaluating the membership and retention subqueries for all of them once per candidate. On a 424,168-claim store that is 79 s per compile against 17.8 ms. The shared predicate added above uses a nested EXISTS so claim_sources seeks its own primary key, and the review queue now uses it. Found by benchmarking the change above; the dual-runtime contract suite passed on both query shapes, because its stores hold tens of rows.

docs/testing/2026-08-07-disputed-authorization.md — n=500, ranked output byte-identical before and after (0/0/500, p = 1.0), compile latency flat within repeat spread. It also states what it cannot show: the corpus holds zero contradicting sources, so it cannot measure the fix where the fix fires.

Webhooks no longer silently drop events written in their own registration millisecond. Eligibility compared w.created_at < e.created_at, a strict comparison on a millisecond wall-clock string, so on a fast host the registration and the next write shared a millisecond and those events were never queued, never delivered, and never retried. Delivery now pages on the event_order.seq watermark that /v1/events and federation already use: migration 22 adds webhooks.created_seq, backfilled to the current head so an upgrade delivers only future events rather than replaying history. Both eligibility sites are converted — processWebhooks and the background deliverPending selector — because the second one would otherwise leave an organization unwoken until another event arrived. Measured on a 16-core host: the contract file went from 8 of 12 runs failing to 12 of 12 passing. Closes #265.

Retrieval ranking is now reproducible in the FTS-only lane. Exactly-tied scores previously fell through to claim_id, a fresh uuid per ingest, so the same corpus ranked differently on every run. Ties now break on the claim statement — content-derived, and compared by code unit so Bun and Workers agree — before falling back to the id. This makes rank reproducible, not better: it picks an arbitrary-but-stable winner among genuine ties. What causes the ties is untouched and stays open as #227. Closes #226.

Upgrading a pre-0.2.0 store now refuses instead of succeeding into silence. Migration 10 scopes team visibility to a workspace and nothing backfills the column, so a 0.1.x store migrated cleanly and then answered 404 on every claim. migrate now counts legacy team rows first and fails closed, naming the count and the 0.2.0 data floor. Rebinding is deliberately not attempted: a legacy row’s real workspace is unknowable, and inventing one would invent an authorization boundary. Closes #257.

The logical export refuses a pre-workspace team row rather than writing a backup its own importer rejects. export_import is advertised as enabled, so an artifact that cannot be restored is worse than an error. Closes #258.

The reranking stage recorded as strategic debt was measured before being written, and the measurement says do not write it. The oracle ceiling over Titen’s own top-10 is +10.2 points (recall@1 0.880 to 0.982), but every cheap reranking signal tested captured at most 0.6 of those points at p=0.61, and two were significantly worse than no reranking at all. MemPalace, which ships one, scored lower with it than without it in both embedding configurations. The gain is real and lexical signals cannot reach it. Closes #269.

In-process mode for Bun hosts. serve() returns the handler it serves, and a titen-memory/bun subpath exports it, so a benchmark or embedding host can drive TitenClient through an injected fetch with no loopback hop. The transport is removed; auth, scopes, and response envelopes are unchanged because it is the same handler. An ephemeral socket is still bound and unused, tracked in PONYTAIL-DEBT.md. Closes #230.

Measured the memory-agent field on an externally authored corpus (LongMemEval-S, MIT) and recorded where Titen actually stands: landscape note. docs/testing/EVALS.md now marks recall@5/@10 as saturated on that corpus so only recall@1 and MRR@10 are quoted as discriminating, and blueprint.md no longer plans a LoCoMo run — LoCoMo is CC BY-NC 4.0 and a launch is commercial use, which an SPDX check misses because GitHub reports it as NOASSERTION. Closes #267, #270, #271.

The single-core throughput ceiling is published as an operator sizing rule in VPS deployment and deploy/README.md: at and above 10,000 claims one client saturates one process, so shard by subject across processes rather than adding clients. Cloudflare records that this is a bun:sqlite property that does not transfer to per-request isolates. Closes #259.

docs/testing/EVALS.md carries the FTS-only degradation curve, so no FTS-only quality figure is quoted without the corpus size it was measured at. Closes #260.

The cross_language:en zero is explained rather than left open: the stratum rotates document language past query language, so it is three language pairs, and English queries never retrieve a non-English document (2,000 of 2,000 top-10 hits). A provider embedding property, not a fixture defect. The fixture is unchanged because its hashes pin the locked holdout and pre-hoc threshold. Closes #245.

docs/engineering/release.md states why the tarball carries no provenance attestation — it requires a supported CI’s OIDC token and this repository publishes by hand on purpose — and gives consumers the registry checks that do work, with what they do not prove. Closes #242.

One product sentence across the GitHub description, README, and package.json. Closes #225.

The npm README now gives one ordered path from CLI install through bootstrap, agent-specific keys, service readiness, and verified MCP setup for Codex, Claude Code, OpenClaw, Hermes, and generic stdio clients.

The host guide separates direct Streamable HTTP from the bundled titen mcp bridge, keeps credentials in host environments, and includes a nine-tool connection check.

Dashboard integration and browser gates no longer share hard-coded port ranges with unrelated development servers.

titen mcp bridges newline-delimited stdio MCP clients to an existing authenticated Titen /mcp endpoint, so hosts without native remote MCP can use the same nine tools without another memory implementation.

MCP initialization now tells compatible hosts to resolve the repository and compile authorized memory once at each task or scope boundary while keeping durable writes explicit and typed.

The stdio bridge accepts its endpoint and revocable key only through the inherited environment, rejects credential-bearing or ambiguous URLs, emits no notification reply, and sanitizes upstream failures without exposing the key.

The canonical schema advances from 20 to 21. Take a verified backup and run titen migrate --dry-run before starting 0.5.5. The migration is additive; rollback restores the backup with the 0.5.4 binary.

Dashboard replicas that must preserve sessions across restarts share one base64url-encoded 32-byte TITEN_DASHBOARD_SESSION_KEY. Without it, each process uses an ephemeral key and restart signs everyone out.

Context compilation accepts an explicit historical at instant and a bounded max_candidates value through REST, MCP, and the TypeScript SDK.

Stable source IDs and canonical claim hashes converge exact re-ingestion after the request idempotency window while changed evidence remains append-only.

POST /v1/index/verify checks a bounded set of active claims against Vectorize or sqlite-vec and queues repairs without reading embedding values.

The publishable OpenClaw bundle now includes remote Streamable HTTP MCP, and the Cursor package includes the metadata and documentation expected by its public plugin repository.

Dashboard login state is an authenticated AES-GCM HttpOnly cookie instead of process-local memory, so a shared key supports replicas without a session database.

Confirmed semantic statement hashes avoid duplicate embedding calls; explicit reconciliation still forces a provider repair when an index record is absent.

Context budget units now use deterministic UTF-8 bytes across runtimes, and Vectorize queries retain the native 100-result ceiling.

The README now leads with Titen’s Level 6 collaboration model and distinguishes evidence-grounded context from storage-only and similarity-only memory.

Public Cloudflare login failures consume the canonical account throttle and a native Rate Limiting binding. The key contains no password or client IP.

Password changes reject common and account-context values before a verifier is stored, while retaining the 15-character minimum and forced first change.

Sealed dashboard sessions reject forged, expired, or undecipherable cookies; raw short-lived API credentials remain outside browser storage.

A checked-in titen-test-* Wrangler profile provisions the isolated live Worker, D1, Vectorize, Workers AI, and Cron contract without storing an account API token in the Worker.

Cloudflare schema readiness verifies the complete migration contract in one D1 read instead of issuing one remote read per required object and column.

New dashboard passwords use six serial PBKDF2-HMAC-SHA-256 stages of 100,000 iterations each, preserving the 600,000-operation work factor within the Workers Web Crypto per-call limit. Bun retains legacy verifier compatibility.

The live semantic verifier uses an explicit bounded index drain; Cron remains a separately observed production reconciler instead of a timing dependency.

The dashboard login username example is now the canonical bootstrap account owner, not a maintainer-specific placeholder.

The Cloudflare runbook provisions the three Vectorize metadata indexes needed for scope-before-search filtering before the first vector upsert.

Live unauthenticated and cross-organization probes fail with non-disclosing 401/404, while native D1, Vectorize, and Workers AI bindings require no account credential inside the deployed Worker.

Bootstrap creates default username owner with a random temporary password; human operators sign in with username/password, and authorized owners/admins can atomically add another account, membership, role, and one-time password. API keys remain unchanged for agents, services, SDKs, CLI recovery, and existing integrations.

Schema 20 adds canonical operator accounts. Temporary-password login is restricted to password replacement; established login issues an eight-hour revocable API credential only to the server-side adapter.

The per-principal sign-in state now uses a focused responsive login surface; the private product sidebar and operator topbar appear only after a valid session instead of framing the unauthenticated form.

Password verifiers use unique salts and PBKDF2-HMAC-SHA-256 with 600,000 iterations on both D1 and Bun/SQLite. Login failures are non-disclosing and locally throttled; password change and logout revoke short-lived dashboard credentials.

The operator dashboard now wires Memories, Context, Work, Audit, Governance, and Federation to fixed authenticated API routes, with capability-gated navigation and no fixture fallback.

Per-principal dashboard login exchanges an API key for an opaque HttpOnly session, and authorized owners/admins can atomically create one human membership plus its one-time API key.

The deployment guide now covers private Tailscale Serve and Cloudflare Tunnel protected by Cloudflare Access while both Titen listeners remain loopback-only.

The public SDK now types all six Memory Atlas lenses and the optional Add User fields on key creation.

Dashboard routes enforce exact Host/Origin, bounded bodies and list results, credential isolation, revocation, expiry, logout/restart invalidation, and server-side authorization independent of browser navigation.

Render the bundled Titen mark by permitting only its data URI alongside same-origin images; remote image sources remain blocked.

titen version --check explicitly reads the stable CLI/plugin release manifest from titen.dev and points users to the manual install guide without background polling or remote command execution.

MCP initialization now reports the package SemVer as serverInfo.version instead of mislabeling a deployment revision such as dev, test, or a Git SHA as the server implementation version.

Published SDK declarations now stay inside the package and exactly type claim inputs, readiness diagnostics/capabilities, key lifecycle fields, and a bounded event iterator that terminates on preserved cursors.

Extraction now supports explicit strict-schema, JSON-object, and custom modes, rejects redirects and incomplete provider finishes, and uses the same model proposal validator as the locked release gate.

Cloudflare liveness no longer waits on D1 preparation, Vectorize queries stay within the platform’s topK limit, and the documented Wrangler recovery command uses a real temporary SQL file.

Bun allows the documented extraction timeout and releases every semantic lease acquired before or during bounded SIGTERM shutdown, so a restart can recover work immediately.

Context packing preserves rank when every item fits, applies diversity only under budget pressure, and no longer awards disputed claims a positive score.

Live semantic verification carries project scope, while historical comparison tooling refuses to present a current deployment as the frozen 0.3.0 target.

D1 diagnostic redaction now covers secrets split across streamed byte and text chunks, and Bun creates the canonical SQLite database plus sidecars with owner-only permissions.

API keys now enforce immutable not-before and expiry windows, update last_used_at monotonically, preserve lifecycle metadata across supported operator surfaces, reject unknown creation fields, and cannot gain authority through credential import.