v0.6.x made ai-memory a fast, token-lean memory server. v0.7.0 made it a substrate that reflects on what it knows and proves who wrote it. v0.8.0 makes that substrate multi-agent. Agents don't just remember — they take turns (single-holder leases on a typed action DAG), hand off work, sign what they say to each other (Ed25519 signals + attested checkpoints), and operate under guardrails an operator controls and can prove. Plus typed cognition (Goal/Plan/Step + a lifecycle_state machine), federation hardened secure-by-default, and a governance hook that actually blocks a refused action.
The whole release is one epic — #1709 — landing the hard parts of a governed multi-agent system in the substrate, tested and portable, instead of re-invented (badly) in every app. Two pillars of new capability, hardened federation, and enforcing governance.
| Area | What landed | Default posture | Status |
|---|---|---|---|
| Pillar-1 — Coordination | Typed action DAG + state machine, single-holder TTL leases (CAS), Ed25519-signed signals, attested checkpoints, replayable routines | Additive tools; drive from MCP / HTTP / CLI | ✅ shipped |
| Pillar-2 — Typed cognition | Goal/Plan/Step memory kinds, a lifecycle_state machine, and the decomposes_into/depends_on/advances link relations |
Additive, permissive options on memory_store/memory_update (no new tool) |
✅ shipped |
| Governance that blocks | Claude Code PreToolUse hook enforces — a substrate Refuse blocks the tool (type:command wrapper); plus an escalate verdict |
Fail-closed when configured; #1811 / #1734 | ✅ shipped |
| Federation hardening | Peer-enrollment required (#1789), per-transition signatures (#1718), per-write content attestation (#1464), transition-replay nonces (#1805), outbound peer-cert pinning (#1678) | Secure by default — several paths fail closed | ✅ shipped |
| Operational controls | HTTP admission control (#1733), deferred AGE graph projection (#1735), curator compaction, mandatory-hook-presence enforcement (#1734) | Opt-in knobs; default behaviour byte-unchanged | ✅ shipped |
| Schema | v57 → v70 — additive coordination / typed-cognition / encryption-prep / archive-edge migrations (v58–v70) | Auto-migrates on first open; archive → restore lossless | ✅ shipped |
Same release, three framings — pick yours.
Nothing to relearn. Install once and your AI keeps a durable, private, self-hosted memory that survives restarts — and now it can safely work alongside other AI assistants without stepping on each other. It remembers context across sessions, can pick up where it left off after a crash, and you stay in control of what it's allowed to do. Your data stays on your machine; nothing is sent to a cloud you don't control.
brew upgrade ai-memory ai-memory doctor
A drop-in upgrade from v0.7.x — the live DB auto-migrates on first open.
requires/unlocks/blocks/gated_by/sibling) with a real state machine, TTL-bounded single-holder leases (CAS conflict semantics), Ed25519-signed signals (typed, threaded, ack'd), Ed25519-attested checkpoints (conditional gates with signed resolution), and replayable routines. Driven from MCP, HTTP, or CLI.Goal/Plan/Step memory kinds, a lifecycle_state machine (open→active→blocked/done/abandoned), and three new typed link relations (decomposes_into/depends_on/advances).--profile full (99 callable + bootstrap) / 7 core · 91 HTTP route registrations (77 unique paths) · 83/85 CLI subcommands · 9 typed link relations · 27-field Memory. SQLite and PostgreSQL+AGE, identical API.v0.8.0 is the release that makes autonomous AI safe to actually run autonomously — and provable to an auditor. Governed & stoppable: every agent action can be gated by operator-signed rules; refusals are enforced and fail closed — you own the kill-switch, cryptographically. Attested & auditable: every write and inter-agent message can be Ed25519-signed; the audit trail is a tamper-evident hash chain — the difference between "the AI says it did X" and "here is signed, replayable proof of what happened." No lock-in: self-hosted, single binary or container, on SQLite or your existing PostgreSQL, provider-agnostic. Real, not vapor: validated by an end-to-end P0–P11 multi-agent validation, a 2-round external-model adversarial security review (every finding fixed), and a live agent-to-agent campaign across heterogeneous models — zero defects.
v0.8.0 is a drop-in for v0.7.x in most surfaces. These callouts are the exceptions worth reading first.
Federation peer-enrollment is now on by default (#1789), and several federation paths fail closed: AI_MEMORY_FED_REQUIRE_PEER_ENROLLMENT is now strict unless explicitly disabled, per-transition signatures are required by default (AI_MEMORY_FED_REQUIRE_TRANSITION_SIG=1, #1718), and a forged signature is rejected unconditionally regardless of any knob.
Mitigation: enroll every peer's Ed25519 key before upgrading a fleet, or set the documented escape-hatch flags (AI_MEMORY_FED_ALLOW_UNENROLLED_PEERS, a falsy AI_MEMORY_FED_REQUIRE_TRANSITION_SIG) for a heterogeneous-rollout window, then flip back. See federation.md and SECURITY.md §v0.8.0 secure-default changes.
The Claude Code PreToolUse governance hook changed to the enforcing type:command form (#1811) so a substrate Refuse genuinely blocks the tool dispatch — an MCP-tool hook structurally cannot block. If you installed the hook before, re-run the installer:
ai-memory install claude-code --hook pretool --apply --force
brew upgrade ai-memory / cargo install ai-memory --force; the live DB auto-migrates v57 → v70 on first open (archive → restore is lossless). The SDKs (@alphaone/ai-memory npm, ai-memory-mcp PyPI) are published at 0.8.0. Pillar-1 / Pillar-2 surfaces are additive — no existing tool, route, or wire shape changes.
Every card below is anchored to the distributed-coordination epic (#1709) and a section in docs/coordination.md. Every tool is verified against the registry (src/mcp/registry.rs).
An action is one node of work — created, claimed, worked, finished — wired into a typed directed dependency DAG via requires/unlocks/blocks/gated_by/sibling edges. A real state machine (pending→claimed→in_progress→done/failed/abandoned) rejects every illegal transition. The frontier / next surfaces let an agent pull the next runnable node, ranked by priority. Schema v59 (actions + action_edges).
A lease is a heartbeat-renewed, expiry-swept claim on an action so two agents don't both work the same node. Acquisition is compare-and-swap: the second acquirer of a still-live lease loses. PRIMARY KEY on action_id enforces one holder at a time. Renew to heartbeat; only the recorded holder may release. Schema v59 (leases).
The typed messaging lane between agents. Each signal carries an Ed25519 signature + sender signer_pubkey and threads via correlation_id + in_reply_to. Types: authorize, notify (default), request, response, broadcast; a NULL to_agent broadcasts. Send / read / inbox / thread-walk / ack. Schema v60 (signals).
A checkpoint blocks until a condition is resolved. Resolution is self-signed in place with the dispatch context's active Ed25519 keypair when present (landing attest_level = self_signed, else unsigned); verification re-checks that attested-resolution signature. Condition types: approval (default), external_signal, condition_predicate, deadline. Schema v61 (checkpoints).
A reusable coordination template authored as a draft, then frozen (immutable, self-signed with an Ed25519 FREEZE-ATTESTATION over its immutable fields). run materialises a concrete set of actions + edges from the {{param}} template into a routine_runs record. Create / freeze / run / status / list. Schema v62 (routines + routine_runs).
Ordinary memories gain the shape of a plan so the coordination DAG has a cognitive counterpart. New memory_kind values goal / plan / step; a first-class lifecycle_state column (schema v64: open→active→blocked/done/abandoned, enforced at the memory_update boundary); and three new typed link relations (schema v63): decomposes_into, depends_on, advances — extending the closed taxonomy from 6 → 9. Additive, permissive options — no new tool.
The Claude Code PreToolUse hook now enforces: a substrate Refuse blocks the tool (an enforcing type:command wrapper — an MCP-tool hook structurally cannot block). Plus mandatory hooks-presence enforcement (#1734) so a missing required pre-write hook fails closed rather than silently no-op'ing, and an escalate verdict for human-in-the-loop. Operator-signed rules an agent cannot forge.
Peer enrollment on by default (#1789), per-transition signatures on authority-granting writes (#1718), per-write content attestation on relayed memories (#1464), 16-byte CSPRNG transition-replay nonces (#1805), and outbound peer server-cert pinning (#1678). The trust is in the Ed25519 signatures, not in good behavior.
ai-memory's architecture scales from one developer's laptop to a multi-region hive of agents without switching products. The coordination + typed-cognition + federation-hardening work in v0.8.0 turns "several agents" into "one coordinated organism that doesn't have to trust its members." Every primitive listed below is in the v0.8.0 binary; you turn flags on as you grow.
ai-memory mcp| Capability | v0.7.0 (attested-cortex) | v0.8.0 (distributed-coordination) |
|---|---|---|
| Multi-agent coordination DAG | ❌ | ✅ typed actions + edges + state machine (memory_action_*) |
| Single-holder work claims | ❌ | ✅ TTL-bounded CAS leases (memory_lease_*) |
| Signed inter-agent messaging | ❌ (webhooks/subscriptions only) | ✅ Ed25519-signals, typed + threaded + ack'd (memory_signal_*) |
| Attested coordination gates | ❌ | ✅ checkpoints with self-signed resolution (memory_checkpoint_*) |
| Replayable plan templates | ❌ | ✅ frozen, signed routines (memory_routine_*) |
| Typed cognition | Form-6 memory_kind vocabulary | ✅ + Goal/Plan/Step + lifecycle_state machine |
| Typed link relations | 6 relations | ✅ 9 (adds decomposes_into/depends_on/advances) |
| Governance actually blocks a tool | ⚠️ MCP-tool hook (cannot block) | ✅ enforcing type:command PreToolUse hook (#1811) + presence enforcement (#1734) |
| Federation peer enrollment | ⚠️ permissive default | ✅ required by default (#1789) |
| Per-transition / per-write attestation | ❌ | ✅ #1718 (transitions) + #1464 (relayed writes) |
| Outbound peer-cert pinning | ❌ | ✅ SSH-known_hosts-style pin file (#1678) |
| Provider-agnostic embeddings | ✅ (#1598) | ✅ unchanged — 15+ vendors, no GPU required |
| Schema | v57 | ✅ v70 (additive v58–v70) |
Pillar-1 adds 26 coordination tools across five families (the MCP surface grows to 100 advertised entries at --profile full — 99 callable + the always-on memory_capabilities bootstrap). Pillar-2 adds no new tool — its Goal/Plan/Step shape rides on additive, permissive fields of memory_store/memory_update. Each tool is verified against src/mcp/registry.rs and documented in docs/coordination.md.
| Family | Tools | Purpose |
|---|---|---|
memory_action_* | create, get, transition, list, add_edge, edges, frontier, next | The typed action DAG + state machine; pull the runnable frontier |
memory_lease_* | acquire, renew, release, get | Single-holder TTL leases (compare-and-swap) on an action |
memory_signal_* | send, read, inbox, thread, ack | Typed, Ed25519-signed, threaded inter-agent messages |
memory_checkpoint_* | create, resolve, query, verify | Attested conditional gates with self-signed resolution |
memory_routine_* | create, freeze, run, status, list | Parameterised, frozen, replayable coordination templates |
HTTP mirrors the two authority-granting coordination writes (#1718): POST /api/v1/actions/{id}/transition (local CAS transition + W-of-N federation fan-out) and POST /api/v1/signals (local send + fan-out), so Postgres-backed / MCP-over-HTTP deployments can drive coordination too.
v0.8.0 follows the same evidence discipline established in v0.7.0 — every claim above resolves to a public, verifiable artifact:
The canonical write-up of Pillar-1 + Pillar-2: actions, leases, signals, checkpoints, routines, the HTTP write surfaces, and the typed-cognition kinds + lifecycle_state machine + new link relations. Every tool is verified against src/mcp/registry.rs; every schema number is cited.
Full track-by-track ship status, the schema v57 → v70 migration ladder (v58–v70), the secure-default flips, and the upgrade / compatibility section. The operator's source of truth for what changed since v0.7.0.
The federation hardening surface — enrollment, per-transition signatures, per-write content attestation, replay nonces, peer-cert pinning — with the exact env-var knobs, fail-closed defaults, and rollout escape-hatches. Read this before upgrading a fleet.
Full CI matrix green on the release commit — Linux/macOS/Windows, the SQLite and PostgreSQL+AGE feature gates, clippy -D pedantic + fmt, per-module coverage, iOS/Android cross-compile, MSRV (Rust 1.96), Docker build, cargo audit clean. Validated by a P0–P11 multi-agent validation, a 2-round external-model security review (every finding fixed), and a live agent-to-agent campaign across heterogeneous models — zero defects.
v0.8.0 (distributed-coordination) is the current GA release. The install channels below publish v0.8.0.
brew install alphaonedev/tap/ai-memory ai-memory install claude-code --apply
cargo install ai-memory --version 0.8.0
docker pull ghcr.io/alphaonedev/ai-memory:0.8.0
sudo dnf copr enable alpha-one-ai/ai-memory sudo dnf install ai-memory
npm install @alphaone/ai-memory
pip install ai-memory-mcp # import name remains ai_memory