Complete changelog
Stable release · npm
latest
npm install -g titen-memory@0.5.5
Install guide · Release page · npm package
Upgrade notes
- The canonical schema advances from 20 to 21. Take a verified backup and run
titen migrate --dry-runbefore starting 0.5.5. The migration is additive; rollback restores the backup with the 0.5.4 binary. - Dashboard replicas that must preserve sessions across restarts share one
base64url-encoded 32-byte
TITEN_DASHBOARD_SESSION_KEY. Without it, each process uses an ephemeral key and restart signs everyone out.
Added
- Context compilation accepts an explicit historical
atinstant and a boundedmax_candidatesvalue through REST, MCP, and the TypeScript SDK. - Stable source IDs and canonical claim hashes converge exact re-ingestion after the request idempotency window while changed evidence remains append-only.
POST /v1/index/verifychecks a bounded set of active claims against Vectorize orsqlite-vecand queues repairs without reading embedding values.- The publishable OpenClaw bundle now includes remote Streamable HTTP MCP, and the Cursor package includes the metadata and documentation expected by its public plugin repository.
Changed
- Dashboard login state is an authenticated AES-GCM HttpOnly cookie instead of process-local memory, so a shared key supports replicas without a session database.
- Confirmed semantic statement hashes avoid duplicate embedding calls; explicit reconciliation still forces a provider repair when an index record is absent.
- Context budget units now use deterministic UTF-8 bytes across runtimes, and Vectorize queries retain the native 100-result ceiling.
- The README now leads with Titen’s Level 6 collaboration model and distinguishes evidence-grounded context from storage-only and similarity-only memory.
Security
- Public Cloudflare login failures consume the canonical account throttle and a native Rate Limiting binding. The key contains no password or client IP.
- Password changes reject common and account-context values before a verifier is stored, while retaining the 15-character minimum and forced first change.
- Sealed dashboard sessions reject forged, expired, or undecipherable cookies; raw short-lived API credentials remain outside browser storage.