ai-memory v0.6.x → v0.7.0 migration quickstart

# 1. Stop ai-memory (whichever launcher you use). Pick ONE:
pkill -INT ai-memory                                                  # CLI-launched
launchctl unload ~/Library/LaunchAgents/<your-ai-memory>.plist        # macOS launchd (if you created a LaunchAgent)
systemctl --user stop ai-memory                                       # Linux systemd
#    (If you launch via Claude Code's MCP config, just close Claude Code.)

# 2. Back up the DB
cp ~/.claude/ai-memory.db{,.v064.bak}      # or wherever your DB lives;
                                            # default v0.7.0 path is the same

# 3. Install v0.7.0 (pick ONE channel)
#    a) Homebrew (after the v0.7.0 release lands on alphaonedev/homebrew-tap):
brew upgrade ai-memory
#    b) Pre-built binary — release assets are named by Rust target triple:
#       ai-memory-x86_64-unknown-linux-gnu.tar.gz, ai-memory-aarch64-unknown-linux-gnu.tar.gz,
#       ai-memory-x86_64-apple-darwin.tar.gz, ai-memory-aarch64-apple-darwin.tar.gz,
#       ai-memory-x86_64-pc-windows-msvc.zip. Example (Linux x86_64):
curl -fsSL "https://github.com/alphaonedev/ai-memory-mcp/releases/download/v0.7.0/ai-memory-x86_64-unknown-linux-gnu.tar.gz" \
  | tar -xz -C ~/.local/bin
#    c) From source (until v0.7.0 ships on crates.io):
cargo install --git https://github.com/alphaonedev/ai-memory-mcp \
  --tag v0.7.0 --locked ai-memory

# 4. Migrate config + scrub the now-redundant ~/.claude.json env block
ai-memory config migrate --also-clean-claude-json

# 5. Restart + verify
#    (Restart your MCP host — Claude Code / Cursor / etc — to pick up
#    the new binary. Then verify wiring end-to-end:)
ai-memory doctor

# 0. Read CONFIG_SCHEMA.md (the canonical v2 schema reference).
#    Read this MIGRATION_QUICKSTART.md and the "What changed" matrix above.
#    Verify your fleet inventory: hostnames, MCP launcher per host,
#    federation peer list (if any), Postgres backend deployments.

# 1. Drain + snapshot per host (run on every fleet member).
#    There is no `ai-memory stop` subcommand — stop via your service
#    manager (or pkill -INT for shell-launched daemons):
for H in $FLEET; do
  ssh "$H" "systemctl --user stop ai-memory && cp ~/.local/share/ai-memory/ai-memory.db{,.v064.bak}"
done

# 2. NFS-shared config.toml — migrate ONCE on the leader, then rsync.
#    (The migrator writes a timestamped .bak; running on N hosts in
#    the same second produces colliding backup filenames.)
LEADER=${FLEET%% *}
# (--dry-run prints the diff to stderr — redirect 2>&1 to capture it)
ssh "$LEADER" "ai-memory config migrate --dry-run 2>&1 | tee ~/v07-config-diff.txt"
# Review the diff. When satisfied:
ssh "$LEADER" "ai-memory config migrate"

# 3. Distribute the rewritten config.toml across the fleet
for H in $FLEET; do
  rsync /nfs/ai-memory/config.toml "$H:/nfs/ai-memory/"
done

# 4. Install v0.7.0 on every host. Assets are named by Rust target
#    triple (e.g. ai-memory-x86_64-unknown-linux-gnu.tar.gz). Pin the
#    expected sha256 per target in your fleet inventory and verify it.
for H in $FLEET; do
  ssh "$H" 'set -e
    TARGET=x86_64-unknown-linux-gnu   # adjust per host arch
    curl -fsSL https://github.com/alphaonedev/ai-memory-mcp/releases/download/v0.7.0/ai-memory-${TARGET}.tar.gz -o ./m.tgz
    echo "${EXPECTED_SHA256}  ./m.tgz" | sha256sum -c -
    tar -xzf ./m.tgz -C /usr/local/bin/
  '
done

# 5. Stage security-posture defaults — temporarily PERMISSIVE so the
#    fleet boots cleanly while peers/agents/policies enrol the new
#    secure-by-default surface. Set in /etc/ai-memory/env (or
#    equivalent systemd EnvironmentFile):
cat >> /etc/ai-memory/env <<'EOF'
# v0.6.x → v0.7.0 staged rollout — flip these back to '1' / '0'
# after fleet enrolment completes (Step 10 below).
AI_MEMORY_FED_REQUIRE_SIG=0
AI_MEMORY_FED_REQUIRE_NONCE=0
AI_MEMORY_PERMISSIONS_MODE=advisory
AI_MEMORY_GOVERNANCE_FAIL_OPEN_ON_ERROR=1
AI_MEMORY_SSRF_GUARD_ALLOW_DNS_FAIL=1
EOF
# (Skip individual lines if your fleet was already strict at v0.6.x.)

# 6. Migrate governance → permissions (v0.7.0 K9/K11 policy refactor).
#    Default (no --config-out) prints the rendered [[permissions.rules]]
#    block without writing; --config-out <config path> merges in place.
ai-memory governance migrate-to-permissions               # preview (dry-run)
ai-memory governance migrate-to-permissions \
  --config-out ~/.config/ai-memory/config.toml            # apply in place

# 7. Start the fleet — DB walks v20 → v55 on first open
for H in $FLEET; do ssh "$H" 'systemctl --user start ai-memory'; done

# 8. Verify per host (the JSON report's pass field is `chain_holds`)
for H in $FLEET; do
  ssh "$H" 'ai-memory doctor && \
            ai-memory verify-signed-events-chain --format json | jq -e .chain_holds'
done

# 9. Provision federation Ed25519 keypairs across the fleet
for H in $FLEET; do
  ssh "$H" "ai-memory identity generate --agent-id ai:daemon@$H"
  # ... and distribute peer pubkeys via your existing key-distribution
  # channel (operator.key.pub, .well-known, signed allowlist, etc.)
done

# 10. Flip security defaults back to the v0.7.0 secure posture
sed -i 's/AI_MEMORY_FED_REQUIRE_SIG=0/AI_MEMORY_FED_REQUIRE_SIG=1/
        s/AI_MEMORY_FED_REQUIRE_NONCE=0/AI_MEMORY_FED_REQUIRE_NONCE=1/
        s/AI_MEMORY_PERMISSIONS_MODE=advisory/AI_MEMORY_PERMISSIONS_MODE=enforce/
        s/AI_MEMORY_GOVERNANCE_FAIL_OPEN_ON_ERROR=1/AI_MEMORY_GOVERNANCE_FAIL_OPEN_ON_ERROR=0/
        s/AI_MEMORY_SSRF_GUARD_ALLOW_DNS_FAIL=1/AI_MEMORY_SSRF_GUARD_ALLOW_DNS_FAIL=0/' \
       /etc/ai-memory/env
for H in $FLEET; do ssh "$H" 'systemctl --user restart ai-memory && ai-memory doctor'; done

grep -l AI_MEMORY_LLM ~/.claude.json && \
  echo "Manual cleanup needed: wrapper-script-launched MCP entries"

#!/usr/bin/env bash
# v0.6.x → v0.7.0 idempotent migration. Run multiple times safely.

set -euo pipefail

VER=v0.7.0
TARGET=x86_64-unknown-linux-gnu   # Rust target triple — adjust per host
EXPECTED_SHA256=<pin-from-your-inventory>
BIN=/usr/local/bin/ai-memory
# Project HARD RULE — no /tmp scratch. Use a local tempdir.
TMP=$(mktemp -d "$PWD/.ai-memory-upgrade-XXXXXX")
trap 'rm -rf "$TMP"' EXIT

# --- 1. Install v0.7.0 binary (idempotent — only fetches if version differs)
if ! "$BIN" --version 2>/dev/null | grep -q "${VER#v}"; then
  curl -fsSL "https://github.com/alphaonedev/ai-memory-mcp/releases/download/${VER}/ai-memory-${TARGET}.tar.gz" -o "$TMP/m.tgz"
  echo "${EXPECTED_SHA256}  $TMP/m.tgz" | sha256sum -c -
  tar -xzf "$TMP/m.tgz" -C "$TMP"
  install -m 0755 "$TMP/ai-memory" "$BIN"
fi

# --- 2. Config migration (idempotent — no-op on schema_version >= 2)
ai-memory config migrate || true

# --- 3. Postgres schema migration (idempotent — schema-init re-runs safely;
#         requires a --features sal,sal-postgres build of the binary)
if [ -n "${AI_MEMORY_STORE_URL:-}" ]; then
  ai-memory schema-init --store-url "$AI_MEMORY_STORE_URL" || true
fi

# --- 4. Governance → permissions (idempotent — in-place merge)
ai-memory governance migrate-to-permissions \
  --config-out ~/.config/ai-memory/config.toml || true

# --- 5. Health gate — fail the play if any check is critical
#        (doctor also exits 2 on its own when any section is critical)
ai-memory doctor --json | jq -e '
  [.sections[] | select(.severity == "critical")] | length == 0
' || { echo "doctor reports CRIT"; ai-memory doctor; exit 1; }
ai-memory verify-signed-events-chain --format json | jq -e '.chain_holds == true'

# --- 6. Apply v0.7.0 secure-default posture (idempotent — env file)
install -d /etc/ai-memory/env.d
cat > /etc/ai-memory/env.d/v07-secure.env <<'EOF'
AI_MEMORY_PERMISSIONS_MODE=enforce
AI_MEMORY_FED_REQUIRE_SIG=1
AI_MEMORY_FED_REQUIRE_NONCE=1
AI_MEMORY_GOVERNANCE_FAIL_OPEN_ON_ERROR=0
AI_MEMORY_PASSPHRASE_FILE_ALLOW_LAX_PERMS=0
AI_MEMORY_SSRF_GUARD_ALLOW_DNS_FAIL=0
EOF

# --- 7. Reload (idempotent — systemd reload is no-op when unchanged)
systemctl --user daemon-reload
systemctl --user reload ai-memory || systemctl --user restart ai-memory