From 960aada769179392a95b3500e10bae9918debb73 Mon Sep 17 00:00:00 2001 From: Joakim Persson Date: Sat, 19 Sep 2026 17:38:02 +0200 Subject: [PATCH] =?UTF-8?q?changelog:=20dependency=20audit=202026-09-19=20?= =?UTF-8?q?=E2=80=94=20mempalace=203.10.0=20measured=20and=20deliberately?= =?UTF-8?q?=20deferred?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every row by direct command: npm/PyPI/GitHub release APIs, git ls-remote, the v1.9.2 config labels via the registry API, and binaries in a running v1.9.2 container for the floating tools. Only pin with a newer upstream is mempalace 3.9.0 -> 3.10.0, and it is NOT a small bump: new installs move to ~/.config/mempalace (entrypoint-user.sh tests ~/.mempalace/palace and entrypoint.sh persists ~/.mempalace, so a fresh container would initialise outside the volume), and mempalace_event_list flips to newest-first by default (the toolkit's deriveClosed passes no order, deriveOwed on 2 of 3 calls — server-default-dependent). Deferred to its own release with the three measured preconditions listed. --- CHANGELOG.md | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 53eea36..45a9071 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,56 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). ## Unreleased +### Dependency audit (2026-09-19) + +Every component checked against upstream by direct command, not assumed. "Baked" +is v1.9.2's published amd64 config labels (read through the registry API) or, +for the floating `*_VERSION=latest` tools, the binaries in a running v1.9.2 +container. + +| Component | Baked in v1.9.2 | Upstream now | Action | +|---|---|---|---| +| pi | `0.85.1` (pinned) | `0.85.1` is npm latest (2026-09-05) | none | +| pi-atelier | `v0.10.1` (pinned) | `v0.10.1` highest tag | none | +| **mempalace** | `3.9.0` (pinned) | **`3.10.0`** (2026-09-16) | **not adopted — see below** | +| skillset (mempalace fallback snapshot) | `e9e45f7` | `--check` OK: `skills/mempalace/SKILL.md` byte-identical at skillset `debc8f6` | none | +| **mempalace-toolkit** | `dab989b` | **`817b3a8`** | ships the mine-deadline fix (above) | +| **pi-toolkit** | `adfb553` | **`9c87ee8`** | ships the `task`-first AGENTS.md (above) | +| **pi-extensions** | `2610545` | **`25c1265`** | ships `task.ts` + `fork-gate.ts` (above) | +| pi-fork | `e69725c` | `e69725c` | none | +| **pi-observational-memory** | `7b397f4` (3.1.1) | **`cba0334`** (3.1.3) | adopted implicitly via `master` (above); peerDeps still `*`, no pi floor to clear | +| pi-studio (studio variant) | `e04fc7a` | `e04fc7a` highest semver tag | none | +| floating `*_VERSION=latest` tools | — | 14 of 16 already at latest; `uv` `0.12.13`→`0.12.17` (four patch releases, none with a Breaking section), `agent-browser` `0.37.1`→`0.38.1` (minor: `screenshot --if-changed`, `snapshot --delta`, persistent refs; `.1` is a recording-timing fix) | adopted implicitly by the rebuild; named here per this repo's floating-ref rule | +| node | major pin `24`, installed `v24.21.0` | `v24.21.0` newest 24.x | none | + +**mempalace 3.10.0 is deliberately not in this release.** It is not a small +bump: a Rust exact-vector engine, four modules split into packages, and three +agent-facing contract changes, two of which touch this image directly — + +- **New installs put config and palace under `~/.config/mempalace`.** + `entrypoint-user.sh` decides "first run" by `[ ! -d ~/.mempalace/palace ]` + and `entrypoint.sh` provisions `~/.mempalace` as the persisted path. On + 3.10.0 a fresh container would initialise into `~/.config/mempalace` — + outside the volume — and the entrypoint's test would stay true on every + start. Whether `MEMPALACE_HOME`/config resolution honours the old path on a + *pre-existing* `~/.mempalace` is stated ("unchanged") but unmeasured here. +- **`mempalace_event_list` defaults to newest-first when no cursor or `order` + is given.** The toolkit's `deriveOwed` passes `order: "desc"` on two of its + three queries and `deriveClosed` on neither, so their windows are + server-default-dependent. That is a server-side skew (the hub is synlig's + stack, whose default image is `joakimp/pi-devbox:latest` — so this pin *is* + the server's next version), and the right fix is in the toolkit: pass + `order` explicitly on every `event_list` call so the derivation is the same + on 3.9 and 3.10 servers. Filed as follow-up; not a blocker for this tag. +- `mempalace rules` dropped `--agent`; `get_collection()` refuses unknown + names — no caller of either in this repo or the toolkit (grepped). + +Adopting it needs its own release: the entrypoint path test, a measured +upgrade of an existing `~/.mempalace`, the toolkit `order` hardening, and the +synlig redeploy sequencing the pin comment in `Dockerfile.base` describes. + +--- + **New check 9 in `scripts/check-doc-drift.sh`: anything the next build would bake differently from the last *published* release must be named in the CHANGELOG text above that release's heading.** The two entries below this one are why. The