Engram changelog

0.3.0 2026-09-12

Added

• Deletes that actually delete — deletion is now erasure end-to-end,

with the paper trail to prove it. Atomic deletes write a database

tombstone in the same transaction (schema v8); an access ledger

records every retrieval and export and is served at /audit/events —

which memories a client touched since a timestamp, and which were

deleted since then (ids and hashes only, never content; schema v9).

Clients label their daemon traffic (X-Engram-Client) so the ledger

names the tool; deletes cascade through consolidation outputs (links

and embeddings); and deleted blobs are garbage-collected from the

sync relay (30-day retention). Removal is real, not "removed from

view."

• Chat bots (Slack, Discord & Telegram) — new engram-chat binary

(crates/engram-chat): capture into your local vault from chat with

four explicit triggers — /remember, @-mentions, emoji reactions

(Slack/Discord), and opt-in per-channel watch. Pull transports only

(Slack Socket Mode, Discord gateway with heartbeats, Telegram

getUpdates long polling with mention-entity detection and

/remember@Bot matching); tokens are env-only and keys never leave

your machine. Honest skips ("duplicate of …") reported back to the

user, daemon-down is logged and never retry-queued. Setup in

docs/engram-product/CHAT.md.

• Per-platform capture sources — chat-bot captures are now sourced

slack / discord / telegram (first-class daemon sources, schema

v7 via axiom-engram 0.1.5) instead of the generic chat, so

per-platform filters work without inspecting context.

• Browser extension — a Manifest V3 popup

(packages/engram-extension/) that captures the page you're on

(selection, title, or link) and searches the vault, straight to your

local daemon. Chrome, Edge, Brave & Firefox (121+); no build step.

Daemon verdicts rendered honestly. Docs in

docs/engram-product/EXTENSION.md.

• Landing — #everywhere now shows Slack, Discord & Telegram and

the browser extension as shipped surfaces (the "coming soon" card is

gone).

• Update notifications — you always know when a newer release exists:

a public changelog page (/changelog), a machine-readable version

endpoint (/version.json), and an RSS feed (/feed.xml) on the site

(all generated at deploy from this CHANGELOG), plus

engram update-check in the CLI and an update banner in the vault UI.

The installer is always the upgrade path — the checks only notify.

• Honest vault metrics — token and CO₂ counters now count at event

time (capture_tokens, dedup_tokens, context_tokens; one-time

backfill for old vaults), with the estimates labeled as estimates

(~4 chars/token, 0.4 g CO₂e per 1K tokens) and engram eco reading

the same counters. Keep-all mode (schedule.keep_all) gates daily

hygiene and weekly consolidation (scheduled and manual), and the

auto-decay switch is now actually wired.

0.2.0 2026-09-04

Added

• Device management — see and control the devices synced to your

vault: a Devices panel in Account & Sync (roster, rename, revoke),

engram devices list/rename/revoke in the CLI, and device labels that

survive daemon restarts. (b610919, e7aadbf, 656b112, c0f6e68)

• Billing plans — three flat plans (personal / team / org) with team

member caps. (091477a)

• Recovery phrase in your hands — download or print the recovery

phrase at signup (b18d7b7), and rotate it later from a modal in the

vault UI (871d324).

• Provenance watermarks — every engram_search and engram_context

result now carries its source: `Engram · vault <id> · N of M

memories`, so you can always tell which facts came from Engram.

Search results keep their relevance scores end-to-end. (7417762)

• engram statusline — a one-line live status bar for Claude Code:

memory count, QEM hit rate, sync state, vault id. engram mcp install

wires it in automatically and never clobbers an existing statusline.

(c680cce)

• Capture standardization — tags are normalized at capture

(lowercased, deduped, capped; generic tags like note dropped),

near-verbatim paraphrases are skipped with an honest report

(similar to <id> (cosine 0.97)), and engram_decay surfaces

near-duplicate pairs and stale working state for review — Engram

reports, the human decides. (882dd27)

• Attribution benchmark — bench/memory now grades whether answers

name their source, alongside recall. (4c06136, 4ac880c, 839269b)

• engram brief + session hooks — a deterministic, bounded session

brief (vault id, memory count, last checkpoint, recent [mem <id>]

pointers) assembled from the daemon's health and search endpoints —

no LLM at brief time. engram mcp install merges Claude Code

SessionStart (engram brief --session) and PreCompact

(engram checkpoint) hooks into ~/.claude/settings.json without

clobbering existing settings, and skips commands already wired.

Daemon down → the brief prints nothing and exits 0.

• engram checkpoint — a metadata-only row per compaction

(Session checkpoint: <cwd> — compacted at <time>, tag checkpoint,

source ai-session). No transcript content is stored — capture stays

explicit.

• Deterministic retrieval ordering — search and context results now

use a total order (score desc, then created_at desc, then id) in the

daemon and both MCP servers, so identical searches return identical

ordering — cache-stable retrieval between calls.

• Token-economy instructions — both MCP servers instruct assistants

to cite retrieved memories as [mem <id>], prefer pointers to

quotes, and retrieve only what the task needs; the local server

documents the task:<name> reuse pattern and its engram_search

forwards a tags filter to the daemon.

• Session metering in the statusline — engram statusline appends

session cost ($x.xx) and total tokens when Claude Code supplies

them (total_cost_usd, total_tokens); still one line, still exits

0 offline.

• Measured bench results — the k=100 memory benchmark, re-run after

the fixes below as one comparable four-condition pass: recall stayed

100% (40/40) through Engram while answer output fell from the

2026-08-21 baseline's 1290.1 to 608.6 mean out-tokens per question

(two clean runs bracket 451–609), shrinking the output premium over

wholesale CLAUDE.md injection from 5.7× to 2.9×; in-tokens (7644) now

roughly match injection (7451) at k=100. Engram sessions still cost

the most in total tokens — "Engram reduces total tokens" remains not

established; see bench/runs/f3-v01/report.md.

Changed

• Session boundaries are not memories — engram checkpoint no longer

writes a memory row per compaction. Boundaries now append one JSON line

to a vault-local session_boundaries.jsonl sidecar (never searched,

never in the feed, never synced), and the session brief reads the newest

line from there. Legacy checkpoint rows are migrated out of the memories

table into the sidecar on daemon start.

• Open-core split — the encryption & storage format moved to its own

public repository, El-AI-Intelligence/engram-format (Apache-2.0, with

a normative FORMAT.md spec). This repository is now the proprietary

product. The private crates depend on the public crate as a git

dependency.

• Vault UI went full-bleed, matching the Guardrail Console. (c19d1d6)
• Brand: "EL AI Intelligence" naming sweep across all surfaces.

(856c014)

Fixed

• engram_context returned empty results — it now returns the assembled

memories with the daemon's [mem] attribution marks. (7417762)

• Empty STRIPE_PRICE_* config is reported as unconfigured (503)

instead of a misleading Stripe 400/502. (5724faf)

• Vault reset links point at /app, where the SPA lives, and the

recovery-phrase warning now comes before the reset link. (e282e3c,

547816a)

• SMTP TLS mode is chosen from the port, not unconditionally. (89f0f85)
• engram-note.sh defaulted to the retired 8799 daemon port. (3382f0e)
• engram capture stored paraphrases as new rows — the CLI never

embedded, so the similarity gate couldn't fire from it. Semantic

captures are now embedded before the write, exactly like the daemon

route. (7275908)

• Vault UI stuck on "reconnecting" — the live feed's WebSocket upgrade

cannot carry the Authorization header the SPA uses for its fetches,

and the browser's auth cache is never primed (the basic-auth challenge

is deliberately stripped), so every handshake was refused. The SPA now

mints a single-use 60-second ticket (POST /ws/ticket, an ordinary

authenticated fetch) and attaches it to the upgrade; the daemon

redeems tickets itself, and the box proxy no longer basic-auths

/ws/events. (ee9168d)

• Live feed still "reconnecting" in local-daemon mode (no box login

stored): the upgrade was built from the page's host while the ticket

was minted against the loopback daemon, so the box rejected a foreign

ticket with 403 every retry. The WebSocket url now derives from the

same daemon base as the mint, so ticket and redeem always hit the

same daemon. (b20b5da)

• Live feed cross-browser audit: Firefox 147+ now gates public sites

from reaching loopback behind a Local Network Access permission (154

extends it to WebSockets), matching Chrome/Edge/Brave 142+ — the

#/connect guide explains the permission so "not detected" users can

allow it, and the daemon CSP plus repo Caddyfile gained the ws://

loopback entries to stay in sync with the deployed policy.

• Local embeddings were near-constant since Aug 13: embed.rs passed

BERT's forward arguments in the wrong order, and the swapped

all-zeros "mask" drove every attention logit to f32::MIN —

uniform attention over the whole sequence, so unrelated texts

compared at cosine ~0.9+. It went unnoticed because hybrid FTS

carried search recall until the 08-28 similarity gate made the

degeneracy visible. The argument order is fixed, hidden dropout is

zeroed (candle applies it unconditionally), and an ignored-offline

real-model test asserts embeddings discriminate. Note: vaults that

stored semantic blobs before this fix hold garbage vectors — a

re-embed sweep of existing blobs is a follow-up.

• Hybrid search demoted vector-only results: the FTS re-weight loop

multiplied the whole scored map by 0.4, so when FTS matched nothing,

semantic hits landed at 0.6 × 0.4 = 0.24 of their cosine. The FTS

weight is now applied to FTS results at insert; vector-only entries

are untouched.

• engram mcp install wrote a bare engram into hook commands, so a

hook could resolve to an older installed copy lacking the new

subcommands and block session start or compaction. Hooks now carry

the absolute path of the binary that ran the install, and re-install

recognizes a bare engram brief/engram checkpoint as the same

command instead of stacking a duplicate.

Docs

• New ATTRIBUTION.md: per-platform matrix of Engram surfaces vs platform

memory, and how to tell which served an answer. (1684b70)

0.1.3 2026-08-26

Added

• Relay-first npm MCP server (@elai-intelligence/engram-mcp) — read

and search your synced memories from any MCP client over the relay, no

local daemon or signing required. Read-only by design; the relay never

sees plaintext. (321e8b0)

• Team vault key handoff — a team member now obtains the shared vault's

key with zero out-of-band transfer: request in the vault UI or via

engram team-handoff, an owner/admin seals it, and the relay carries it

in a zero-knowledge P-256 ECDH mailbox (ciphertext erased on delivery).

(922281c, 6ddaaf7)

• SPA: explicit "Engram not detected on this machine" states plus a

connect-this-machine guide. (b24ed38, 06fc9e5)

• Landing: Slack & Discord card marked coming soon. (a32b180)

Changed

• License: FSL-1.1-MIT — the repo is now source-available under the

Functional Source License with a 4-year conversion to MIT. Free to use,

modify, and self-host forever; the one restriction is offering Engram as

a competing hosted service. (b9382fe)

• Explicit-capture policy everywhere — connecting Engram never

auto-captures. The policy is carried into every MCP session via the

instructions field, tool descriptions, health output, CLI

install/status, and both SPA capture surfaces. (a997528, 5e2581e)

• Passkeys are scoped to the Engram UI's own RP ID

(engram.ellmstack.dev), and passkey manager labels are the account

email. (8231b87, 79d404d)

• Quota 402s are human-readable now: e.g. `device quota reached (1 of 1

devices) — upgrade your plan (Account & Sync → Billing, personal

$10/mo). (903995f`)

Fixed

• CLI vault-resolution divergence — engram could silently create a

new cwd-relative vault while the daemon used the configured one;

resolution now escalates exactly like the daemon. (ddc65c4)

• engram capture on passphrase-protected vaults. (6dde4f2)
• SPA add-passkey now gates on the account password for fresh accounts.

(2708206)

Removed

• Unsigned Windows binaries are withheld from releases until code signing

is available; Linux/macOS artifacts ship as before. (707aa51)

0.1.2 2026-08-21

Per-vault pairing codes and cross-platform installer work.

Added

• Pairing codes now carry their vault: browser-side mint with a vault

picker, flag-free redeem in the CLI. (af160a8, 103740a)

• Cross-platform uninstall commands. (af29354)

Changed

• Windows installer footer lists onboarding + MCP install (was stale

init-era text); install.ps1 is ASCII-only for PowerShell 5.1. (b8e23c6,

84d845a)

0.1.1 2026-08-21

Third-party QC security review remediation (2026-08-20) and a product

rename: the product is now presented as Engram by EL AI Intelligence

across the CLI, vault UI, landing page, installers, MCP tool descriptions,

and documentation (binary and package names are unchanged). Full scope:

daemon trust model, UI XSS, relay tenant isolation, KDF hardening, and

misc hardening — all findings reproduced against HEAD before fixing.

Security

• Key-handoff mint gating — POST /sync/key-handoff/start now requires

the daemon's admin credential (ENGRAMD_API_KEY, or a daemon-generated

token persisted 0600 to {vault}/.handoff-token when the env var is

unset). Browser redeem stays token-only. (090e997)

• WS/CORS origin pinning — /ws/events upgrades are origin-gated, and

the CORS layer no longer echoes arbitrary localhost:* ports; exact

origins only, ENGRAM_CORS_ORIGINS for development. (b6e9e81)

• SPA XSS — every template interpolation in the vault UI is escaped

(incl. '), hrefs are encodeURIComponent-encoded, and a CSP

(csp_headers middleware + meta tag) plus X-Content-Type-Options and

X-Frame-Options: DENY are set on daemon responses. (17943b9)

• Import hardening — imported memories are validated (plain ids,

bounded content/project lengths) and rejected items are reported in the

response. (17943b9)

• Relay tenant isolation — account API keys are scoped per vault;

unscoped ("account-wide") keys minted before this release are

policy-denied with a 403 that asks the device to re-link. Pair/link

mints carry a client-derived vault_id; key mints are refused for

vaults the account doesn't own. (e88a630)

• Passkey rate limits + login caps — register start/finish and login

start are rate-limited; login-passkey lookups are filtered and capped

per account. (e88a630)

• SMTP STARTTLS-mandatory — the relay's reset-mail transport uses

Tls::Wrapper (opportunistic downgrade removed). (e88a630)

• Vault-wrap fresh-password gate — storing a key wrap now re-verifies

the account password; the SPA prompts when needed. (e88a630)

• KDF v2 vault ids — the passphrase→vault-id derivation uses a new

domain salt and higher Argon2id cost (96 MiB); unpinned devices probe

the relay and converge on whichever derivation (v2 or legacy v1) already

EXISTS, creating fresh vaults under v2. Pinned ids are untouched; a

rejected api_key aborts sync (daemon stays up). (247ca39)

• Pair onto manually-named vaults — engram pair --vault-id <id>

overrides the passphrase-derived vault id and pins it into

config.json, so devices can join teams whose vault id was named by

hand (engram join) — passphrase convergence can never reach those. (9b70f31)

• MCP capture honesty — engram_capture checks the daemon's HTTP

status and reports rejection bodies (401/403) instead of a false

"captured successfully". (8cdb5d1)

• Purge date validation — before_date must be RFC3339; a malformed

string (which previously matched the whole vault via lexical SQL

comparison) is rejected with 400 before anything is deleted. (8cdb5d1)

Fixed

• Password reset responses are uniform (sent: true whenever SMTP is

configured) — no account enumeration via reset. (e88a630)

• Privacy audit dashboard returns real sync_enabled/local_only values

instead of placeholders. (8cdb5d1)

Docs

• SYNC.md — per-vault key scoping, legacy-key 403 re-link guidance, KDF

v2 convergence behavior, ENGRAM_CORS_ORIGINS usage. (this release)

0.1.0 2026-08-19

First public release. Passphrase-encrypted local vault, end-to-end

encrypted multi-device sync (dumb relay), passkey accounts + one-click

device linking/pairing, weekly digest, MCP server, browser vault UI,

Windows/macOS daemons, Docker image, Homebrew formula, apt/deb packaging.