Engram by EL AI Intelligence — Changelog

Engram 0.3.0

Sat, 12 Sep 2026 00:00:00 +0000

### Added

- **Deletes that actually delete** — deletion is now erasure end-to-end,
  with the paper trail to prove it. Atomic deletes write a database
  tombstone in the same transaction (schema v8); an access ledger
  records every retrieval and export and is served at `/audit/events` —
  which memories a client touched since a timestamp, and which were
  deleted since then (ids and hashes only, never content; schema v9).
  Clients label their daemon traffic (`X-Engram-Client`) so the ledger
  names the tool; deletes cascade through consolidation outputs (links
  and embeddings); and deleted blobs are garbage-collected from the
  sync relay (30-day retention). Removal is real, not "removed from
  view."
- **Chat bots (Slack, Discord & Telegram)** — new `engram-chat` binary
  (`crates/engram-chat`): capture into your local vault from chat with
  four explicit triggers — `/remember`, @-mentions, emoji reactions
  (Slack/Discord), and opt-in per-channel watch. Pull transports only
  (Slack Socket Mode, Discord gateway with heartbeats, Telegram
  getUpdates long polling with mention-entity detection and
  `/remember@Bot` matching); tokens are env-only and keys never leave
  your machine. Honest skips ("duplicate of …") reported back to the
  user, daemon-down is logged and never retry-queued. Setup in
  `docs/engram-product/CHAT.md`.
- **Per-platform capture sources** — chat-bot captures are now sourced
  `slack` / `discord` / `telegram` (first-class daemon sources, schema
  v7 via `axiom-engram` 0.1.5) instead of the generic `chat`, so
  per-platform filters work without inspecting context.
- **Browser extension** — a Manifest V3 popup
  (`packages/engram-extension/`) that captures the page you're on
  (selection, title, or link) and searches the vault, straight to your
  local daemon. Chrome, Edge, Brave & Firefox (121+); no build step.
  Daemon verdicts rendered honestly. Docs in
  `docs/engram-product/EXTENSION.md`.
- **Landing** — `#everywhere` now shows Slack, Discord & Telegram and
  the browser extension as shipped surfaces (the "coming soon" card is
  gone).
- **Update notifications** — you always know when a newer release exists:
  a public changelog page (`/changelog`), a machine-readable version
  endpoint (`/version.json`), and an RSS feed (`/feed.xml`) on the site
  (all generated at deploy from this CHANGELOG), plus
  `engram update-check` in the CLI and an update banner in the vault UI.
  The installer is always the upgrade path — the checks only notify.
- **Honest vault metrics** — token and CO₂ counters now count at event
  time (`capture_tokens`, `dedup_tokens`, `context_tokens`; one-time
  backfill for old vaults), with the estimates labeled as estimates
  (~4 chars/token, 0.4 g CO₂e per 1K tokens) and `engram eco` reading
  the same counters. Keep-all mode (`schedule.keep_all`) gates daily
  hygiene and weekly consolidation (scheduled and manual), and the
  auto-decay switch is now actually wired.

Engram 0.2.0

Fri, 04 Sep 2026 00:00:00 +0000

### Added

- **Device management** — see and control the devices synced to your
  vault: a Devices panel in Account & Sync (roster, rename, revoke),
  `engram devices list/rename/revoke` in the CLI, and device labels that
  survive daemon restarts. (`b610919`, `e7aadbf`, `656b112`, `c0f6e68`)
- **Billing plans** — three flat plans (personal / team / org) with team
  member caps. (`091477a`)
- **Recovery phrase in your hands** — download or print the recovery
  phrase at signup (`b18d7b7`), and rotate it later from a modal in the
  vault UI (`871d324`).
- **Provenance watermarks** — every `engram_search` and `engram_context`
  result now carries its source: `Engram · vault  · N of M
  memories`, so you can always tell which facts came from Engram.
  Search results keep their relevance scores end-to-end. (`7417762`)
- **`engram statusline`** — a one-line live status bar for Claude Code:
  memory count, QEM hit rate, sync state, vault id. `engram mcp install`
  wires it in automatically and never clobbers an existing statusline.
  (`c680cce`)
- **Capture standardization** — tags are normalized at capture
  (lowercased, deduped, capped; generic tags like `note` dropped),
  near-verbatim paraphrases are skipped with an honest report
  (`similar to  (cosine 0.97)`), and `engram_decay` surfaces
  near-duplicate pairs and stale working state for review — Engram
  reports, the human decides. (`882dd27`)
- **Attribution benchmark** — bench/memory now grades whether answers
  name their source, alongside recall. (`4c06136`, `4ac880c`, `839269b`)
- **`engram brief` + session hooks** — a deterministic, bounded session
  brief (vault id, memory count, last checkpoint, recent `[mem ]`
  pointers) assembled from the daemon's health and search endpoints —
  no LLM at brief time. `engram mcp install` merges Claude Code
  SessionStart (`engram brief --session`) and PreCompact
  (`engram checkpoint`) hooks into `~/.claude/settings.json` without
  clobbering existing settings, and skips commands already wired.
  Daemon down → the brief prints nothing and exits 0.
- **`engram checkpoint`** — a metadata-only row per compaction
  (`Session checkpoint:  — compacted at `, tag `checkpoint`,
  source ai-session). No transcript content is stored — capture stays
  explicit.
- **Deterministic retrieval ordering** — search and context results now
  use a total order (score desc, then created_at desc, then id) in the
  daemon and both MCP servers, so identical searches return identical
  ordering — cache-stable retrieval between calls.
- **Token-economy instructions** — both MCP servers instruct assistants
  to cite retrieved memories as `[mem ]`, prefer pointers to
  quotes, and retrieve only what the task needs; the local server
  documents the `task:` reuse pattern and its `engram_search`
  forwards a `tags` filter to the daemon.
- **Session metering in the statusline** — `engram statusline` appends
  session cost (`$x.xx`) and total tokens when Claude Code supplies
  them (`total_cost_usd`, `total_tokens`); still one line, still exits
  0 offline.
- **Measured bench results** — the k=100 memory benchmark, re-run after
  the fixes below as one comparable four-condition pass: recall stayed
  100% (40/40) through Engram while answer output fell from the
  2026-08-21 baseline's 1290.1 to 608.6 mean out-tokens per question
  (two clean runs bracket 451–609), shrinking the output premium over
  wholesale CLAUDE.md injection from 5.7× to 2.9×; in-tokens (7644) now
  roughly match injection (7451) at k=100. Engram sessions still cost
  the most in total tokens — "Engram reduces total tokens" remains not
  established; see `bench/runs/f3-v01/report.md`.

### Changed

- **Session boundaries are not memories** — `engram checkpoint` no longer
  writes a memory row per compaction. Boundaries now append one JSON line
  to a vault-local `session_boundaries.jsonl` sidecar (never searched,
  never in the feed, never synced), and the session brief reads the newest
  line from there. Legacy checkpoint rows are migrated out of the memories
  table into the sidecar on daemon start.
- **Open-core split** — the encryption & storage format moved to its own
  public repository, `El-AI-Intelligence/engram-format` (Apache-2.0, with
  a normative `FORMAT.md` spec). This repository is now the proprietary
  product. The private crates depend on the public crate as a git
  dependency.
- Vault UI went full-bleed, matching the Guardrail Console. (`c19d1d6`)
- Brand: "EL AI Intelligence" naming sweep across all surfaces.
  (`856c014`)

### Fixed

- `engram_context` returned empty results — it now returns the assembled
  memories with the daemon's `[mem]` attribution marks. (`7417762`)
- Empty `STRIPE_PRICE_*` config is reported as unconfigured (503)
  instead of a misleading Stripe 400/502. (`5724faf`)
- Vault reset links point at `/app`, where the SPA lives, and the
  recovery-phrase warning now comes before the reset link. (`e282e3c`,
  `547816a`)
- SMTP TLS mode is chosen from the port, not unconditionally. (`89f0f85`)
- `engram-note.sh` defaulted to the retired 8799 daemon port. (`3382f0e`)
- `engram capture` stored paraphrases as new rows — the CLI never
  embedded, so the similarity gate couldn't fire from it. Semantic
  captures are now embedded before the write, exactly like the daemon
  route. (`7275908`)
- Vault UI stuck on "reconnecting" — the live feed's WebSocket upgrade
  cannot carry the Authorization header the SPA uses for its fetches,
  and the browser's auth cache is never primed (the basic-auth challenge
  is deliberately stripped), so every handshake was refused. The SPA now
  mints a single-use 60-second ticket (`POST /ws/ticket`, an ordinary
  authenticated fetch) and attaches it to the upgrade; the daemon
  redeems tickets itself, and the box proxy no longer basic-auths
  `/ws/events`. (`ee9168d`)
- Live feed still "reconnecting" in local-daemon mode (no box login
  stored): the upgrade was built from the page's host while the ticket
  was minted against the loopback daemon, so the box rejected a foreign
  ticket with 403 every retry. The WebSocket url now derives from the
  same daemon base as the mint, so ticket and redeem always hit the
  same daemon. (`b20b5da`)
- Live feed cross-browser audit: Firefox 147+ now gates public sites
  from reaching loopback behind a Local Network Access permission (154
  extends it to WebSockets), matching Chrome/Edge/Brave 142+ — the
  #/connect guide explains the permission so "not detected" users can
  allow it, and the daemon CSP plus repo Caddyfile gained the `ws://`
  loopback entries to stay in sync with the deployed policy.
- Local embeddings were near-constant since Aug 13: `embed.rs` passed
  BERT's `forward` arguments in the wrong order, and the swapped
  all-zeros "mask" drove every attention logit to `f32::MIN` —
  uniform attention over the whole sequence, so unrelated texts
  compared at cosine ~0.9+. It went unnoticed because hybrid FTS
  carried search recall until the 08-28 similarity gate made the
  degeneracy visible. The argument order is fixed, hidden dropout is
  zeroed (candle applies it unconditionally), and an ignored-offline
  real-model test asserts embeddings discriminate. Note: vaults that
  stored semantic blobs before this fix hold garbage vectors — a
  re-embed sweep of existing blobs is a follow-up.
- Hybrid search demoted vector-only results: the FTS re-weight loop
  multiplied the whole scored map by 0.4, so when FTS matched nothing,
  semantic hits landed at 0.6 × 0.4 = 0.24 of their cosine. The FTS
  weight is now applied to FTS results at insert; vector-only entries
  are untouched.
- `engram mcp install` wrote a bare `engram` into hook commands, so a
  hook could resolve to an older installed copy lacking the new
  subcommands and block session start or compaction. Hooks now carry
  the absolute path of the binary that ran the install, and re-install
  recognizes a bare `engram brief`/`engram checkpoint` as the same
  command instead of stacking a duplicate.

### Docs

- New ATTRIBUTION.md: per-platform matrix of Engram surfaces vs platform
  memory, and how to tell which served an answer. (`1684b70`)

Engram 0.1.3

Wed, 26 Aug 2026 00:00:00 +0000

### Added

- **Relay-first npm MCP server** (`@elai-intelligence/engram-mcp`) — read
  and search your synced memories from any MCP client over the relay, no
  local daemon or signing required. Read-only by design; the relay never
  sees plaintext. (`321e8b0`)
- **Team vault key handoff** — a team member now obtains the shared vault's
  key with zero out-of-band transfer: request in the vault UI or via
  `engram team-handoff`, an owner/admin seals it, and the relay carries it
  in a zero-knowledge P-256 ECDH mailbox (ciphertext erased on delivery).
  (`922281c`, `6ddaaf7`)
- SPA: explicit "Engram not detected on this machine" states plus a
  connect-this-machine guide. (`b24ed38`, `06fc9e5`)
- Landing: Slack & Discord card marked coming soon. (`a32b180`)

### Changed

- **License: FSL-1.1-MIT** — the repo is now source-available under the
  Functional Source License with a 4-year conversion to MIT. Free to use,
  modify, and self-host forever; the one restriction is offering Engram as
  a competing hosted service. (`b9382fe`)
- **Explicit-capture policy everywhere** — connecting Engram never
  auto-captures. The policy is carried into every MCP session via the
  `instructions` field, tool descriptions, health output, CLI
  install/status, and both SPA capture surfaces. (`a997528`, `5e2581e`)
- Passkeys are scoped to the Engram UI's own RP ID
  (`engram.ellmstack.dev`), and passkey manager labels are the account
  email. (`8231b87`, `79d404d`)
- Quota 402s are human-readable now: e.g. `device quota reached (1 of 1
  devices) — upgrade your plan (Account & Sync → Billing, personal
  $10/mo)`. (`903995f`)

### Fixed

- **CLI vault-resolution divergence** — `engram` could silently create a
  new cwd-relative vault while the daemon used the configured one;
  resolution now escalates exactly like the daemon. (`ddc65c4`)
- `engram capture` on passphrase-protected vaults. (`6dde4f2`)
- SPA add-passkey now gates on the account password for fresh accounts.
  (`2708206`)

### Removed

- Unsigned Windows binaries are withheld from releases until code signing
  is available; Linux/macOS artifacts ship as before. (`707aa51`)

Engram 0.1.2

Fri, 21 Aug 2026 00:00:00 +0000

Per-vault pairing codes and cross-platform installer work.

### Added

- Pairing codes now carry their vault: browser-side mint with a vault
  picker, flag-free redeem in the CLI. (`af160a8`, `103740a`)
- Cross-platform uninstall commands. (`af29354`)

### Changed

- Windows installer footer lists onboarding + MCP install (was stale
  init-era text); install.ps1 is ASCII-only for PowerShell 5.1. (`b8e23c6`,
  `84d845a`)

Engram 0.1.1

Fri, 21 Aug 2026 00:00:00 +0000

Third-party QC security review remediation (2026-08-20) and a product
rename: the product is now presented as **Engram by EL AI Intelligence**
across the CLI, vault UI, landing page, installers, MCP tool descriptions,
and documentation (binary and package names are unchanged). Full scope:
daemon trust model, UI XSS, relay tenant isolation, KDF hardening, and
misc hardening — all findings reproduced against HEAD before fixing.

### Security

- **Key-handoff mint gating** — `POST /sync/key-handoff/start` now requires
  the daemon's admin credential (`ENGRAMD_API_KEY`, or a daemon-generated
  token persisted 0600 to `{vault}/.handoff-token` when the env var is
  unset). Browser redeem stays token-only. (`090e997`)
- **WS/CORS origin pinning** — `/ws/events` upgrades are origin-gated, and
  the CORS layer no longer echoes arbitrary `localhost:*` ports; exact
  origins only, `ENGRAM_CORS_ORIGINS` for development. (`b6e9e81`)
- **SPA XSS** — every template interpolation in the vault UI is escaped
  (incl. `'`), hrefs are `encodeURIComponent`-encoded, and a CSP
  (`csp_headers` middleware + meta tag) plus `X-Content-Type-Options` and
  `X-Frame-Options: DENY` are set on daemon responses. (`17943b9`)
- **Import hardening** — imported memories are validated (plain ids,
  bounded content/project lengths) and rejected items are reported in the
  response. (`17943b9`)
- **Relay tenant isolation** — account API keys are scoped per vault;
  unscoped ("account-wide") keys minted before this release are
  policy-denied with a 403 that asks the device to re-link. Pair/link
  mints carry a client-derived `vault_id`; key mints are refused for
  vaults the account doesn't own. (`e88a630`)
- **Passkey rate limits + login caps** — register start/finish and login
  start are rate-limited; login-passkey lookups are filtered and capped
  per account. (`e88a630`)
- **SMTP STARTTLS-mandatory** — the relay's reset-mail transport uses
  `Tls::Wrapper` (opportunistic downgrade removed). (`e88a630`)
- **Vault-wrap fresh-password gate** — storing a key wrap now re-verifies
  the account password; the SPA prompts when needed. (`e88a630`)
- **KDF v2 vault ids** — the passphrase→vault-id derivation uses a new
  domain salt and higher Argon2id cost (96 MiB); unpinned devices probe
  the relay and converge on whichever derivation (v2 or legacy v1) already
  EXISTS, creating fresh vaults under v2. Pinned ids are untouched; a
  rejected api_key aborts sync (daemon stays up). (`247ca39`)
- **Pair onto manually-named vaults** — `engram pair --vault-id `
  overrides the passphrase-derived vault id and pins it into
  `config.json`, so devices can join teams whose vault id was named by
  hand (`engram join`) — passphrase convergence can never reach those. (`9b70f31`)
- **MCP capture honesty** — `engram_capture` checks the daemon's HTTP
  status and reports rejection bodies (401/403) instead of a false
  "captured successfully". (`8cdb5d1`)
- **Purge date validation** — `before_date` must be RFC3339; a malformed
  string (which previously matched the whole vault via lexical SQL
  comparison) is rejected with 400 before anything is deleted. (`8cdb5d1`)

### Fixed

- Password reset responses are uniform (`sent: true` whenever SMTP is
  configured) — no account enumeration via reset. (`e88a630`)
- Privacy audit dashboard returns real `sync_enabled`/`local_only` values
  instead of placeholders. (`8cdb5d1`)

### Docs

- `SYNC.md` — per-vault key scoping, legacy-key 403 re-link guidance, KDF
  v2 convergence behavior, `ENGRAM_CORS_ORIGINS` usage. (this release)

Engram 0.1.0

Wed, 19 Aug 2026 00:00:00 +0000

First public release. Passphrase-encrypted local vault, end-to-end
encrypted multi-device sync (dumb relay), passkey accounts + one-click
device linking/pairing, weekly digest, MCP server, browser vault UI,
Windows/macOS daemons, Docker image, Homebrew formula, apt/deb packaging.