v0.23.1 - Full Local Hardening

Agent Memory Bridge 0.23.1 closes the actionable reliability and governance
gaps found in the v0.23.0 audit. The work stays local-first: SQLite remains the
authority, derived indexes remain rebuildable, and background execution remains
a single-machine service. The public MCP surface grows from 10 to 12 tools with
explicit annotate and revise operations.

0.23.1 = authority-safe enrichment, generation-safe cursors, observable local service ownership, typed governed storage, and operator-grade local maintenance.

Authority and governed writes

• Classifier output keeps classifier_suggested_tags separate from policy tags.
  Only domain: and topic: suggestions can be promoted after confidence
  validation; reserved governance prefixes are rejected defensively.
• Assist-mode confidence must be present, finite, and within [0, 1].
• annotate adds non-policy tags and provenance without rewriting content.
• revise creates the successor and supersession receipt in one transaction.
  Hidden learning candidates and review records cannot use revision to bypass
  their authority boundary.
• Schema version 3 adds typed metadata, normalized tags, indexed relations,
  insertion sequences, annotations, revision receipts, and a database epoch.
• forget, Signal cleanup, and profile-source pruning share one governed
  deletion primitive that maintains tombstones, edge targets, and degraded
  lineage evidence.

Cursors, Signals, and restore safety

• Reflex and consolidation use monotonic insertion-sequence cursors with legacy
  since_id compatibility. Equal timestamps and reused memories.rowid values
  cannot skip a record.
• Signal poll cursors carry namespace, insertion sequence, and database epoch.
  Their sequence is taken from the query result snapshot, so deleting the page
  boundary record cannot move the cursor backward.
• Restore uses the SQLite backup API, coordinates with the service lock,
  preserves a recovery backup, and rotates the database epoch. Old poll cursors
  fail clearly; reflex, consolidation, and embedding state reset safely. Restore
  is offline maintenance: the service and all MCP/client writers must be stopped
  because arbitrary writers do not participate in the service lock.
• Signal health checks validate timestamps and lifecycle combinations.
  signal-repair can recover malformed rows explicitly.
• hardened-local requires claim-before-ack. Signal ownership remains
  cooperative local coordination, not authenticated identity.

Service and command-provider reliability

• The service owns bridge-home/service.lock through a POSIX flock or Windows
  msvcrt lock by default. --allow-multiple-services is an explicit unsafe
  override.
• service --once returns 0 on success, 1 when an enabled lane fails, and
  3 on lock conflict.
• service-health.json records PID, cycle timestamps, lane status, last success,
  duration, and consecutive failures. Slow sequential lanes are visible even
  though AMB does not attempt unsafe in-process cancellation.
• Classifier and embedding providers use argv arrays with shell=False by
  default, sanitized environments, bounded stdin/stdout/stderr, timeout
  enforcement, command fingerprints, and process-tree termination. Trusted
  shell is an explicit compatibility option and is forbidden by
  hardened-local.
• The embedding scheduler drains a bounded number of batches per service cycle
  and uses a short delay while backlog remains.

Retrieval, database, and operations

• Semantic recall performs exact cosine scoring over every eligible namespace
  row. semantic_scan_limit now controls provider batch size rather than a
  recent-row cutoff. Hybrid recall uses reciprocal-rank fusion.
• Indexed lineage removes full-table text parsing, preflights the closure outside
  the write lock, and revalidates it in the short governed deletion transaction.
• Duplicate writes report title, tag, and provenance differences instead of
  silently hiding metadata drift.
• db-health checks SQLite quick/full integrity, foreign keys, structured data,
  Signal state, and typed projections. --repair-projections rebuilds content
  hashes, metadata, tags, relations, and FTS from authoritative rows.
• backup, verify-backup, restore, wal-checkpoint, and dry-run-first
  signal-cleanup provide supported maintenance paths.
• Managed directories and files receive private POSIX modes where supported.
  Doctor reports unsafe permissions, database/WAL size warnings, and stale
  service health. Managed JSONL logs rotate with bounded retention.
• The container is built from a wheel in a multi-stage image and runs as UID
  10001 with a private data directory.

Validation snapshot

• pytest: 546 passed
• Ruff lint and format checks pass
• core mypy checks pass
• release, public-surface, and onboarding contracts pass
• dependency audit reports no known vulnerabilities
• wheel/sdist build and Twine validation pass
• Docker build, version, and non-root UID smoke checks pass

The final validation lines above are release gates: if any gate is rerun and
fails, the release is not ready until the claim is corrected or the failure is
fixed.

Boundaries

AMB remains intended for trusted local use. hardened-local is a stricter
single-machine profile, not multi-user isolation. This release does not add
authenticated clients, per-namespace ACLs, sandboxed command execution,
exactly-once delivery, distributed locks, a hosted queue, ANN indexing, lane
cancellation, or compliance guarantees. Exact semantic scoring and some
maintenance operations remain linear in store size; operators should measure
their own corpus before treating AMB as large-scale infrastructure.