Every path into your memory now runs through one gated engine — and that engine is now a product other apps can embed.
New
- The memory engine is now a real Swift package with a versioned public contract, so another application can link it in-process and get the same memory — same guards, same index, same secret scan — without running Memophant. The first external embed is already live and verified end-to-end.
- Every route to durable state — memory, wiki, design, code, tasks, sessions, templates, vendors, and documents — now passes through the engine's gate: validation, the write-time secret scan, provenance, and indexing apply uniformly whether the write comes from the app, an agent, or the Curator. An enforcement instrument holds the number of bypass paths at zero so one can't quietly reappear.
- One-shot search from the command line: memophant-mcp search answers a lexical query straight from the index with no server running, opening the index read-only so a query can never mutate your memory.
- Claude hook wiring moved to user scope — registered once, machine-wide, instead of per-project. Existing projects migrate automatically, and a hook file that can't be written fails loudly instead of silently.
Improved
- Your writes can't be silently lost: every write funnel now rides a real compare-and-swap with recompose-on-conflict, so two writers landing on the same note merge instead of one clobbering the other — and editing a note refuses an ambiguous replace instead of guessing.
- The secret scan got sharper with its wider reach: agent-written documents are scanned both when written and when imported, prose that merely talks about key formats no longer blocks a save, and no surface in the app will render a blocklisted secret.
- Tasks joined the same argument contract as memory: creating a task refuses an invalid status or priority instead of silently swallowing it, and mistyped arguments are refused with the valid ones named.
- A locked license session now recovers on the next call instead of staying dead until restart, and a locked gate reports the real reason it's locked.
- The app stops guessing: a failed credential read shows as a failure rather than an empty state, and document import failures land in a report channel a reload can't clear.
Fixed
- Long subprocess output is no longer silently truncated, which could drop the tail of a generation or audit.
- Spurious "database is locked" failures under concurrent access are fixed — the busy timeout now applies to every connection.
- Renaming a note takes its permalink with it, fixing the ghost that broke editing a wiki page after a rename.
- Custom memory folder locations are retired: memory is pinned to .memory/, and legacy configurations migrate automatically.
- A project whose index has no rows now reports that condition instead of answering every search with an empty success.