Skip to content

This release adds 4 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agent-framework agent-orchestration ai-infra ai-interface context-engineering context-management
+4 more
go long-horizon-agents long-horizon-intelligence rust

Affected surfaces

auth breaking_upgrade

Summary

AI summary

Dashboard image now runs a locked Node 24 production build with optimized Next.js server.

Full changelog

ContextLattice v4.0.3: Production Means Production.

ContextLattice already had the right dashboard. v4.0.3 makes sure it ships as one.

The CLI remains the primary interface. The dashboard, HTTP, and MCP remain companion surfaces.

What Changed

  • The dashboard image now performs a locked Node 24 production build and starts the optimized Next.js server instead of the development server.
  • Runtime startup uses the bundled Prisma client, performs the required schema synchronization, and never asks npx to fetch packages from the network.
  • Container health now checks the live /api/public/auth-mode contract, proving both application readiness and runtime mode resolution.
  • Status probes wait for runtime mode and skip hosted-only billing capability checks in account-free local mode.
  • Long project and topic paths now wrap inside their rails, trees, and sidecars without causing desktop or mobile horizontal overflow.
  • The Node runtime audit now rejects dashboard images that regress to development mode, omit a production build/start path, lack the runtime healthcheck, or allow network-fetching npx startup behavior.
  • Historical paid-release replays now preserve the approved amended source identity through nested artifact checks without moving immutable tags.

What Did Not Change

  • The CLI-first agent contract.
  • Gateway, retrieval, storage, session, runner, and inference semantics.
  • Public local mode remains account-free; hosted authentication remains opt-in through AUTH_REQUIRED=true.
  • The public Apache-2.0 and commercial BUSL-1.1 source boundary.
  • Aggregate Signal remains a controlled activation preview under its existing privacy and utility gates.

Upgrade

Existing v4 installations can update normally. No data migration or new required service is introduced.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track sheawinkler/ContextLattice

Get notified when new releases ship.

Sign up free

About sheawinkler/ContextLattice

Private-by-default memory and context layer for agents with Go/Rust runtime, staged retrieval across fused data backends, and long-horizon context continuity.

All releases →

Related context

Earlier breaking changes

  • v3.17.3 Agent guidance now mandates the `/agents/tasks` route family.
  • v3.17.3 Task worker now checks approval before any execution steps.

Beta — feedback welcome: [email protected]