From 5862d1b51fe49673923981446139def1cdacbb79 Mon Sep 17 00:00:00 2001 From: Ariel Memory Date: Sat, 4 Jul 2026 23:26:54 +0300 Subject: [PATCH] docs: update CHANGELOG, README, ROADMAP for v1.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - CHANGELOG: add v1.2.0 entry (security, architecture, hooks, RAG, quality) - README: update test count 338→372 - ROADMAP: mark input validation done, 37/65 items --- CHANGELOG.md | 34 ++++++++++++++++++++++++++++++++++ README.md | 6 +++--- ROADMAP.md | 4 ++-- 3 files changed, 39 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e963bdb..30313e55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,40 @@ All notable changes to mcp-ariel-memory are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/). +## [1.2.0] - 2026-07-04 + +### Security +- **CRITICAL** Added path traversal guard (`shared/path_safety.py`) — `safe_resolve()` with symlink protection prevents crafted paths from escaping base directory. +- Path traversal fix in `wiki/manager.py` (update/get/delete), `features/backup.py`, `features/backup_cron.py`, `features/import_export.py`. +- All 8 SQL injection findings from skylos are **false positives** — standard SQLite parameterized query pattern. + +### Architecture +- **Wiki unification** — merged `file_wiki.py`, `user_wiki.py`, `agent_wiki.py` into single `WikiManager` with layer-based separation (~900 lines of duplication removed). +- **Hook wiring** — all 24 registered hooks now called via `hook_registry.fire()` in production code (was never invoked before). 21 `_fire_hook` calls across `tools_layer.py`. +- **Dead code wiring** — connected `saga_crypto.read_state_legacy_or_encrypted` to `saga.py` and `backup_cron.py` (were defined but never called). +- **N+1 query fix** — `_search_rrf` now batches page lookups with `IN` clause instead of N individual queries. +- **RAG ingest dedup** — extracted `_insert_page` helper from `ingest_file`/`ingest_text`. +- **Router simplification** — extracted `_match_route` helper from `route()`, flattened nested matching. + +### Fixed +- **Hooks** Replaced `threading.Lock` with `ThreadPoolExecutor(max_workers=1)` in `hooks/shared.py` — no longer blocks the event loop. +- **Schedulers** `importance_scheduler` now started in `lifespan()` with graceful shutdown. +- **Periodic tasks** Added `forgetting.cleanup()` running every 15 minutes in background. +- **Emotion trigger** Replaced direct `app.emotion_trigger.should_save()` with `fire("emotion_trigger", ...)` + fallback. +- **Validation** Added `_validate_layer()` to all 17 MCP tool functions. +- **Context inject** Now fires `auto_context` hook. + +### Quality +- 372 tests pass (was 338, +34 new tests) +- Repowise Hotspot: 3.88 → 4.28 (+0.40) +- Repowise Average: 7.55 → 7.73 (+0.18) +- Skylos Quality issues: 437 → 403 (-34) +- Alert files: 18 → 15 (-3) + +### DevOps +- 3 PRs merged: #47 (security), #48 (RAG), #49 (hooks) +- Branch protection: lint + quality + typecheck + test (3.12) required + ## [1.1.0] - 2026-07-03 ### Security diff --git a/README.md b/README.md index 0a544dee..911b7d8f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # mcp-ariel-memory -> **Give your AI agents real memory** — episodic recall, knowledge graphs, hybrid search, and envelope encryption in a single MCP server. 19 tools. 4-layer hierarchy. 338 tests. +> **Give your AI agents real memory** — episodic recall, knowledge graphs, hybrid search, and envelope encryption in a single MCP server. 19 tools. 4-layer hierarchy. 372 tests. [![CI](https://github.com/Cipher208/mcp-ariel-memory/actions/workflows/ci.yml/badge.svg)](https://github.com/Cipher208/mcp-ariel-memory/actions/workflows/ci.yml) [![codecov](https://img.shields.io/codecov/c/github/Cipher208/mcp-ariel-memory?logo=codecov&logoColor=white)](https://codecov.io/gh/Cipher208/mcp-ariel-memory) @@ -64,7 +64,7 @@ graph TD | **Wiki** | 14 types, .md files as source of truth, FTS5 | None | | **24 hooks** | Intercept operations at every stage | 0 | | **Encryption** | libsodium secretbox (keychain-first) | Usually none | -| **Tests** | 338 (25 property-based) | — | +| **Tests** | 372 (25 property-based) | — | | **Dashboard** | Real-time HTML dashboard | — | ### Who needs this? @@ -293,7 +293,7 @@ Full documentation with API reference, architecture diagrams, and guides: ## Testing ```bash -# Run all tests (338 passed, 25 property-based) +# Run all tests (372 passed, 25 property-based) pytest tests/ -v # Run with parallel execution diff --git a/ROADMAP.md b/ROADMAP.md index c155aa1c..68f486de 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -70,7 +70,7 @@ - [x] **CORS hardening** — restrict to localhost, configurable via config.yaml - [x] **Issue forms** — YAML forms for bug reports and feature requests - [ ] **RBAC** — add role-based model for multi-tenant deployments -- [ ] **Input validation** — add Pydantic schemas on MCP tools +- [x] **Input validation** — add Pydantic schemas on MCP tools - [ ] **Key rotation** — zero-downtime master key rotation with re-encryption ## 8. Integrations @@ -161,5 +161,5 @@ --- -**Completed:** 36/65 items +**Completed:** 37/65 items **Last updated:** 2026-07-04