Tags

v0.9.5

Release 0.9.5 — fully automatic semantic search

alethech search --query 'kubernetes deploy'

That's it. No flags. No manual install.全自动.

First run: auto-downloads sentence-transformers + 90MB model (cached).
Future runs: instant, model already loaded.
No network: falls back to TF-IDF automatically.

CI: 11/11 green
Tests: 354 passed
Commit: 4ec406c8a3e22720432271a3341439de637e17bd

v0.9.4

Release 0.9.4 — neural semantic search + enhanced TF-IDF

3 search modes:
1. TF-IDF (default, zero deps): alethech search --query 'kubernetes'
2. Enhanced (fuzzy): alethech search --query 'k8s' --enhanced
3. Neural (semantic): pip install alethech[semantic] && alethech search --query 'deploy' --semantic

CI: 11/11 green
Tests: 354 passed
Commit: 479a630ddf21fc6f673bbe9463d4f37fabec9971

v0.9.3

Release 0.9.3 — local-first semantic search

New: local-first semantic search over verified memory.
No server, no GPU, no model download. TF-IDF + cosine similarity.

- alethech/search.py: LocalSearch, recall(), TFIDFEmbedder
- CLI: alethech search --query 'kubernetes' --top-k 5
- API: from alethech import recall
- 16 new tests (354 total)
- CI: 11/11 green

Commit: 69957ad86a1f1973c5c7f7cf88978fb8389bc02a

v0.9.2

v0.9.1

Release 0.9.1 — chat capture + portable memory + cross-platform

First release with chat capture from active tab.
No .aleth file needed to create your first memory.

CI: 11/11 green
Commit: 1f7356f671b91b3bfa31d8fb51efc4f4e3f5f222

v0.9.0

Release 0.9.0 — ALETH002 cross-language + recovery UI

Minor bump: ALETH002 (recovery code) implemented in Python, TypeScript,
Rust, and WASM. Browser extension popup has full recovery flow UI.

What's new:
- TS: sealAlethV2, recoverAlethV2, migrateAlethV1ToV2
- Rust: seal/recover/migrate CLI subcommands
- WASM: open_aleth_v2_passphrase, open_aleth_v2_recovery,
  seal_aleth_v2, recover_aleth_v2, generate_recovery_secret
- Browser extension: create/rotate/recover UI
- Cross-language interop verified: TS↔Python, Python↔TS
- CI: 6/7 green (GitGuardian false positive on golden.vector)

Commit: 6eb8ae563e18d95ba702336e46dc80d244c89c40

v0.8.5

Release 0.8.5 — FIRST CI-TRUSTED-PUBLISH RELEASE

Includes fix: sigstore artifacts moved to separate signatures/ dir
so gh-action-pypi-publish doesn't try to upload .sigstore.json
as a package.

Commit: 957783a2145cdfa983629270c40a10cb7f10cf66

v0.8.4

Release 0.8.4 — audit closure + cross-language conformance in CI

What's new since 0.8.3:
- Cross-language harness fails closed (exit 2) when runtime missing
- CI builds Rust helper, runs Python + Rust + TS together (8/8 green)
- Source-inspection pseudo-security test removed, replaced by behavioral
- PyPI trusted publishing configured (workflow ready, awaiting PyPI registration)
- All metadata synchronized to 0.8.4 (Python + TypeScript + Rust)

PyPI: https://pypi.org/project/alethech/0.8.4/
npm: https://www.npmjs.com/package/alethech-ts (0.8.4)
Commit: a7bb76e

Artifact SHA-256:
  wheel: c954b35961144b71deba33bee06ca56983218691243e95586c71ddf559abd35d
  sdist: 9c7879b2b6ce6242a9917b9f3d8f1cd60483975bbc126eb51e62fb5f1a1cc337

Note: this PyPI artifact was uploaded manually via twine (transitional).
The CI trusted-publish workflow is configured but PyPI trusted publisher
registration is pending. v0.8.5+ will be the first fully CI-published
release. See docs/RELEASE.md for instructions.

v0.8.3

Release 0.8.3 — cross-language harness: Rust + TypeScript runners

Sixth audit pass. Closes the finding that the cross-language
conformance harness existed but only had Python runner.

What's new:
- Rust runner: alethech-rs/src/bin/conf.rs
- TypeScript runner: alethech-ts/conformance.mjs (verified working)
- Harness logic: skips missing implementations cleanly

Verification: Python vs TypeScript cross-validated, 0 disagreements
on all 15 shared fixtures. Rust runner code complete, pending build
in CI (no cargo in this environment).

PyPI: https://pypi.org/project/alethech/0.8.3/
Commit: 470dea4

Artifact SHA-256:
  wheel: f320a6bd73c00b77a47f0e4d1e2977cff9f3aa183d3201630e32a97434d8bdf9
  sdist: b616e88e1d897e05bb09f4ec87cb4b1d07e12d9c50d24a24fa4d76bf169ea02d

v0.8.2

Release 0.8.2 — fifth audit pass

4 findings from the fifth external audit fixed:
1. Atomic import (staging dir + os.replace)
2. Checkpoint key_id signer binding (V2 schema)
3. Cross-language conformance harness (executable evidence for README claim)
4. Release provenance (this tag + GitHub release + PyPI artifact SHA-256)

PyPI: https://pypi.org/project/alethech/0.8.2/
Commit: c9dc704
Date: 2026-09-29

Artifact SHA-256:
  wheel: 9c563bccedf039cab2a02341239809fe0497f7a28026482356f9749b975f1d1d
  sdist: 62a98ff1ee4ee00d3231e08d8c0fd7c661d40548c568c2b43d2fccdd0213f868

v0.7.0

alethech v0.7.0 — atomic import + fail-closed + artifact hash + spec cleanup

5 audit findings closed:
1. Atomic import transaction (staging + verify + atomic write)
2. Fail-closed checkpoint semantics (count mismatch = error)
3. Artifact hash check during import (fail-closed)
4. Spec drift: MemexExport → AlethechExport, did:memex → did:alethech
5. Trust gate for IdentityRecordV2

230 tests passing.

v0.6.0

alethech v0.6.0 — conformance + import hardening + anti-rollback

3 audit findings closed:
1. Conformance vectors (15 adversarial vectors)
2. Import hardening (path traversal, symlinks, archive bombs)
3. Anti-rollback (monotonic sequence in checkpoints)

Repo cleanup: legacy/memex moved to separate repo (eddyflores100-lang/memex-legacy).
alethech now has exactly 1 branch (main), no legacy branches.

225 tests passing.

v0.5.8

alethech v0.5.8 — JCS RFC 8785 conformance fix

Two bugs in 0.5.7's JCS serializer, both caught by external audit:

1. -0 was preserved as '-0' — RFC 8785 erratum says -0 → '0'
2. Positive exponents had '+' stripped — RFC 8785 keeps '1e+21'

Both fixed. All 56 JCS tests now assert correct RFC 8785 semantics.

v0.5.7

alethech v0.5.7 — protocol closed

Two bloqueantes closed (0.5.6):
  #1 Checkpoint continuity — checkpoint.head_commit_id must be
     ancestor of current HEAD (not just present + count match)
  #2 Root binding — explicit root_id binding between RootAuthority,
     IdentityRecord, and ControlEvent

JCS RFC 8785 conformance (0.5.7):
  56 test vectors covering integer/float serialization, -0
  preservation, scientific notation format, UTF-16 key ordering
  with surrogate pairs, string escaping, NaN/Infinity rejection.
  canonical.py fixed to match ECMAScript Number.prototype.toString().

Total: 196 tests passing. 8 mutation-guard paths.

audited-crypto-state-v0.5.5

Audited cryptographic state — alethech 0.5.5

Reachability guarantee enforced via ancestry_check() in verify_store.
5 mutation paths covered (3 code-level, 2 data-level / recall-seam).

Verdict semantics (rev 3.x):
  commit ∈ ancestry(cutoff_head)  →  VALID_HISTORICAL
  commit ∉ ancestry(cutoff_head)  →  NOT_IN_PROVEN_PRE_ROTATION_HISTORY

No temporal claims. No REVOKED_KEY_AFTER_CUTOFF verdict.

This tag is the frozen reference. No commits on top of it may change
cryptographic semantics without a new tag and explicit justification.

Files at this tag:
  protocol-rev2/alethech/verify.py    — reachability + recall-seam defense
  protocol-rev2/tests/test_revoked_key_reachability.py — 14 tests
  protocol-rev2/pyproject.toml         — alethech 0.5.5, MIT

Mutation test results (all 5 detected):
  M1: disable revoked-key check          → 3 tests fail
  M2: ancestry_check True→False          → 4 tests fail
  M3: ancestry_check False→True          → 5 tests fail
  M4: active-keys defense disabled       → 2 tests fail
  M5: cutoff_head mismatch disabled      → 2 tests fail