This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+4 more
Affected surfaces
Summary
AI summaryUpdates One exact truth, Boundaries preserved, and No registry, no guess across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Refactor | Medium |
Operator-configured runtime-state mirrors overwrite their canonical file instead of accumulating semantic history. Operator-configured runtime-state mirrors overwrite their canonical file instead of accumulating semantic history. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
Exact state is excluded from rollups, graph confidence, access learning, Qdrant, pgvector, and ordinary memory fanout. Exact state is excluded from rollups, graph confidence, access learning, Qdrant, pgvector, and ordinary memory fanout. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
A final gateway barrier suppresses stale exact-state rows from every retrieval source, including old external indexes. A final gateway barrier suppresses stale exact-state rows from every retrieval source, including old external indexes. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
Startup performs one short bounded slice, then a single cross-process-locked background worker finishes the repair. Startup performs one short bounded slice, then a single cross-process-locked background worker finishes the repair. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
The gateway creates an owner-only empty registry before readers recover. The gateway creates an owner-only empty registry before readers recover. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
Reader mounts remain read-only; only the two intended storage owners can mutate the shared memory volume. Reader mounts remain read-only; only the two intended storage owners can mutate the shared memory volume. Source: llm_adapter@2026-07-14 Confidence: high |
— |
| Refactor | Medium |
Owner-only migration streams now fix-size directory batches instead of sorting an unbounded tree in memory. Owner-only migration streams now fix-size directory batches instead of sorting an unbounded tree in memory. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Refactor | Medium |
Durable receipts bind completion to root identity and writer policy; legacy or mismatched receipts are reverified. Durable receipts bind completion to root identity and writer policy; legacy or mismatched receipts are reverified. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Refactor | Medium |
Rust readers fail closed when the registry is missing, malformed, oversized, or contains unsafe path keys. Rust readers fail closed when the registry is missing, malformed, oversized, or contains unsafe path keys. Source: llm_adapter@2026-07-14 Confidence: low |
— |
| Refactor | Medium |
Unix enforcement is descriptor-relative, Windows uses protected ACLs, and health/status surfaces expose opaque store references rather than host paths. Unix enforcement is descriptor-relative, Windows uses protected ACLs, and health/status surfaces expose opaque store references rather than host paths. Source: llm_adapter@2026-07-14 Confidence: low |
— |
Full changelog
ContextLattice v3.17.5 - Current Means Current
Memory should compound. State should not.
A live position, policy snapshot, runtime mode, or queue watermark has one job: tell the truth now. v3.17.5 gives that truth its own exact-state lane, keeps stale copies out of semantic memory, and closes the last paths that could let yesterday's state masquerade as today's answer.
One exact truth
- Operator-configured runtime-state mirrors overwrite their canonical file instead of accumulating semantic history.
- Exact state stays out of rollups, graph confidence, access learning, Qdrant, pgvector, and ordinary memory fanout.
- A final gateway barrier suppresses stale exact-state rows from every retrieval source, including old external indexes.
- Rust accelerators and Mongo-derived snapshots consume the same bounded path registry, while Meilisearch deletes state documents that predate the boundary.
Private without the startup punishment
- Owner-only migration streams fixed-size directory batches instead of sorting an unbounded tree in memory.
- Startup performs one short bounded slice, then a single cross-process-locked background worker finishes the repair.
- Durable receipts bind completion to root identity and writer policy; legacy or mismatched receipts are reverified.
- Unix enforcement is descriptor-relative, Windows uses protected ACLs, and health/status surfaces expose opaque store references rather than host paths.
No registry, no guess
- The gateway creates an owner-only empty registry before readers recover.
- Rust readers fail closed when the registry is missing, malformed, oversized, or contains unsafe path keys.
- Reader mounts remain read-only; only the two intended storage owners can mutate the shared memory volume.
Boundaries preserved
- The CLI remains the primary interaction path.
- Public and paid feature boundaries remain intact.
- No third-party agent harness is installed automatically.
- No new daemon, scheduler, or Python live-runtime dependency was added.
- Public artifacts contain no private planning material or machine-local paths.
Verification
The release gate covers full and race-enabled Go tests, Go vet, Linux release tests for both changed Rust crates, rustfmt, Clippy with warnings denied, Windows changed-surface compilation, full and lite Compose rendering, exact-state and owner-only audits, public lane and leak guards, source-integrity checks, installer workflows, live cutover, and rollback rehearsal.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About sheawinkler/ContextLattice
Private-by-default memory and context layer for agents with Go/Rust runtime, staged retrieval across fused data backends, and long-horizon context continuity.
Related context
Related tools
Beta — feedback welcome: [email protected]