EverOS 1.2.1

[embedding] and [rerank] configuration become optional at runtime — EverOS now boots with only [llm] configured and degrades into three capability tiers, with a new everos cascade backfill command to fill in rows written without an embedding provider.

This release also hardens the cascade queue's retry and delete handling, and fixes a path traversal in knowledge upload — see Security for the affected versions.

Added

• [embedding] and [rerank] are now soft runtime dependencies — EverOS boots and serves requests with only [llm] configured. A missing or misconfigured embedding / rerank / multimodal provider no longer aborts startup; the accessor logs <provider>_capability_build_failed and reports available=False. Features degrade into three tiers: Tier 1 ([llm] only) → KEYWORD search + add/flush + md writes + cascade sync; Tier 2 (+ [embedding]) → adds VECTOR/HYBRID search + reflection + skill extraction + backfill; Tier 3 (+ [rerank]) → adds AGENTIC search + knowledge write/search. Tier upgrades require a server restart. Downgrades are read-safe: knowledge documents stay readable / renamable / deletable after a Tier-3 → Tier-2 downgrade; only write and search endpoints return 422.
• everos cascade backfill CLI command — three-phase interactive backfill (vectors → clusters → skills, or --phase all) that upgrades Tier-1 rows to Tier-2 once [embedding] is configured. Each phase prints row / token estimates and blocks on y/N; --yes / -y for CI. Exit codes: 0 success, 1 user declined, 2 phase preconditions unmet, 3 server running, 4 completed-with-failures, 130 SIGINT.
• LanceDB schema v2 — the six business tables (episode, atomic_fact, foresight, agent_case, agent_skill, knowledge_topic) now allow vector NULL, so cascade can write rows without vectors when [embedding] is unavailable and a later backfill fills them in. The migration runs once on first startup under a cross-process memory_root_lock (fcntl.flock), followed by a per-table optimize(cleanup_older_than=timedelta(0)) to physically prune older manifest versions.
• Startup unbackfilled-rows banner — after the LanceDB lifespan, a sweep emits unbackfilled_memory_rows when rows with vector IS NULL exist, pointing at everos cascade backfill.
• PyPI Trusted Publishing workflow — tag-triggered .github/workflows/release.yml builds, smoke-tests and uploads via OIDC (no stored token) behind the release environment's manual-approval gate. A version / tag mismatch aborts the publish. Companion /release skill lives under .claude/skills/release/.

Changed

• ProviderNotConfiguredError → HTTP 422 CAPABILITY_UNAVAILABLE — write / search endpoints that need embed or rerank now return 422 with a section-aware hint (pointing at the everos.toml section, never at EVEROS_* env vars) instead of erroring at startup or 500-ing at request time.
• GET /health returns a Pydantic HealthResponse model — with typed capabilities and disabled_features fields, so OpenAPI codegen produces real shapes instead of additionalProperties: true.
• MemoryRoot.default() → MemoryRoot.resolve() — renamed to make the precedence walk (--root / EVEROS_ROOT / default) explicit. A default() alias is kept as a backward-compatibility shim that forwards to resolve() and emits a DeprecationWarning; it will be removed in a future major release, so update call sites when convenient.
• Uncalibrated recall scores moved to their own name — KEYWORD and single-route VECTOR searches now report their top score as recall_top_score_raw; recall_top_score is reserved for the calibrated methods (HYBRID LR sigmoid, AGENTIC cross-encoder), whose values share a comparable [0, 1] scale. Langfuse aggregates scores by name, so the previous single name meant a chart could average an unbounded BM25 score together with a probability. Every recall score also carries metadata = {"method": ..., "calibrated": ...}. Dashboards built on recall_top_score for keyword search need to switch to the new name.
• Docs and examples now use /api/v2 — README, QUICKSTART, the docs/ reference set, the Langfuse example and everos demo --live all call the canonical /api/v2 prefix. /api/v1 keeps resolving to the same handlers, so nothing breaks, but it is now described as a legacy compatibility alias that may be removed in a future major release rather than a permanent one. New integrations should target /api/v2.
• cluster_repo.find_cluster_id_for_member now requires (app_id, project_id, owner_id) — reverse-index lookups JOIN Cluster for scope filtering. entry_id is per-owner unique by design, so the reverse index alone could collide across owners writing on the same day.
• All six cascade handlers register unconditionally — a Tier-3 → Tier-2/1 downgrade no longer strands DELETE / PATCH events. Embed-requiring branches inside each handler body-guard on capability availability at execution time.
• Interactive TTY log level defaults to WARNING — keeps INFO lines from drowning out the backfill y/N prompts; non-interactive / CI stays at INFO, and --verbose / -v forces INFO.
• click>=8.1 promoted to a first-class dependency — previously transitive via typer. typer.Abort and click.exceptions.Abort are distinct classes under typer 0.15+, so the interrupt catch in cascade backfill covers both.
• Test harness pins EVEROS_ROOT to a temp path — conftest.py scrubs every EVEROS_* env var so a developer's ~/.everos/everos.toml cannot make tests accidentally green against a real provider.

Fixed

• Cascade retry classification and total-retry budget — the worker now catches ExternalServiceError (transient embedding / LLM / rerank failures) and retries inline up to 3 times before marking a row retryable=True. A total budget of 12 attempts across scanner cycles bounds retrying during a prolonged outage, and failed rows with retryable=False on a stable mtime skip auto-retry, so editing and re-saving the md is what grants another attempt.
• The reconciler no longer overwrites the worker's mark_done — pending / processing rows with a stable mtime are no longer re-enqueued. SQLite REAL round-trip precision loss in mtime comparisons is absorbed with a 10 ms tolerance.
• A file deleted while its modified event was still queued is now processed as a deletion — previously the handler raised FileNotFoundError, which left a stale indexed row and a permanently failed queue item behind.
• Stuck optimize() escalates to a full index rebuild — after 5 consecutive failures the worker falls back to drop_index + create_index instead of letting compaction and version cleanup stay wedged (workaround for the lance-format/lance#7653 panic path).
• The embedding provider raises on HTTP 200 with empty data — it previously returned zero-length vectors silently, corrupting search results.
• Episode extraction retries on malformed LLM output — the synchronous /flush path retries everalgo ValueError (typically a truncated provider response) twice with 1 s / 2 s backoff before surfacing a 500.
• Filename validation on knowledge upload — NUL bytes and filenames longer than 255 UTF-8 bytes now fail fast with InvalidInputError → HTTP 400 instead of surfacing OS errors as a 500 with a half-written md file.
• HTML upload no longer takes the UTF-8 fast path — knowledge upload's plaintext short-circuit uses an explicit allowlist (text/plain, text/markdown, text/x-rst, text/x-markdown) plus known extensions; text/html is deliberately excluded so HTML still goes through everalgo's clean_html_for_llm. Prevents a 503 when a Tier-3 user without [multimodal] uploads a markdown doc.
• Broken table-of-contents links in docs/api.md — the endpoint anchors still pointed at the pre-1.2.0 #post-apiv1… slugs after the headings moved to /api/v2, leaving all five TOC links dead.

Removed

• README "Star us" section.

Security

• Knowledge upload path traversal (CWE-22) — the knowledge document upload joined the untrusted multipart filename into _original/ verbatim, so an absolute or ..-laden filename let a caller write attacker-controlled bytes outside the document directory. The filename is now reduced to a safe basename, and the resolved target is asserted to stay inside _original/ before any filesystem touch.

  Affected: every release before 1.1.4, and 1.2.0. Not affected: 1.1.4. Fixed in: 1.2.1. The fix shipped in 1.1.4 but was not present on the branch 1.2.0 was built from, so upgrading 1.1.4 → 1.2.0 reintroduced it.

Upgrade

pip install --upgrade everos   # or: uv sync

On first startup after upgrading, LanceDB runs the schema-v2 migration once — it takes a cross-process lock and optimizes each table afterwards. No manual steps. If rows were written while [embedding] was unavailable, the startup banner will point you at everos cascade backfill to fill in their vectors.

Full changelog: v1.2.0...v1.2.1

EverOS 1.2.0

EverOS 1.2.0

Minor release adding the /api/v2 API prefix and native OpenTelemetry tracing.

Added

• /api/v2 API prefix — every business endpoint (memory/*, ome/*, knowledge/*) is now served under /api/v2, aligning the open-source API with the EverOS Cloud contract. /api/v1 is retained as a permanent, backward-compatible alias: both prefixes resolve to the same handlers with identical contracts, so existing integrations keep working unchanged.
• Native OpenTelemetry tracing — memory operations (add/flush, memcell boundary, episode extraction, search, and OME reflection) export to any OTLP backend (e.g. Langfuse) as nested traces carrying LLM/embedding token usage, per-request correlation, and recall-quality scores. Off by default; enable via [observability] with the optional otel extra. Content capture (query / extracted memory) is opt-in and redaction-aware.

Upgrade

pip install --upgrade everos

Or update the project environment with uv sync.

Full changelog: v1.1.4...v1.2.0

EverOS 1.1.4

Note on the published package: the everos==1.1.4 release on PyPI was built from a separate internal release lane and contains fixes that are not in this tag's source — including a knowledge-upload path-traversal fix (CWE-22). See the 1.1.4 section of CHANGELOG.md for the full list, and the v1.2.1 notes for the affected-version range.

EverOS 1.1.4

Patch release adding Langfuse observability and fixing cascade file deletion races.

Added

• Langfuse OpenTelemetry integration example for tracing add, flush and extraction, search, and reflection operations.

Fixed

• Process a queued modified event as a deletion when the source file disappears, preventing stale indexed rows and permanently failed queue items.
• Limit synthetic Langfuse child spans to responses with stage details so live-server traces use real telemetry.

Upgrade

pip install --upgrade everos

Or update the project environment with uv sync.

Full changelog: v1.1.3...v1.1.4

EverOS 1.1.3

EverOS 1.1.3

Fixes unbounded index growth from a LanceDB FTS regression.

Fixed

• LanceDB FTS with_position crashes optimize(), bloating the index
  until the disk fills. On lancedb ≥ 0.32, FTS indexes built with
  with_position=True crash lance's optimize() / compaction when it merges
  an unindexed tail (Max offset exceeds length of values — an upstream
  lance-encoding v4 → v6 regression, reported at
  lance-format/lance#7653).
  Because the crash aborted optimize() including version cleanup, the
  index directory grew without bound.

  The fix:

  • FTS now defaults to with_position=False — lossless for EverOS, since
    recall uses OR-mode BM25 and never runs phrase queries.
  • A marker-guarded startup migration rebuilds pre-fix indexes and reclaims
    the orphaned fragments automatically.
  • Consecutive optimize() failures now escalate warning → error instead
    of being swallowed silently.

Upgrade

pip install --upgrade everos   # or: uv sync

Existing installations are migrated automatically on next startup — the
pre-fix index is rebuilt once and the leaked fragments are reclaimed. No
manual steps required.

Full changelog: v1.1.2...v1.1.3

EverOS 1.1.2

EverOS 1.1.2

Fixes agent-track search.

Fixed

• Agent-track search broken by deprecated_by IS NULL filter.
  compile_filters() unconditionally appended a deprecated_by IS NULL
  clause to every LanceDB query, but only the episode and atomic_fact
  tables carry that column. As a result, agent-track search (agent_case,
  agent_skill) failed on every method. The clause is now applied
  conditionally, only when owner_type == "user".

Upgrade

pip install --upgrade everos   # or: uv sync

No configuration or data-migration changes required.

Full changelog: v1.1.1...v1.1.2

EverOS 1.1.1

EverOS 1.1.1

EverOS 1.1.1 focuses on benchmark reproducibility, search quality, and keeping the public GitHub release aligned with the 1.1.1 source package while preserving GitHub-only project assets.

Highlights

• Added the LoCoMo benchmark runner under benchmarks/, including TOML configuration, an environment template, staged ingestion/search/answer/judge execution, result artifacts, and benchmark documentation to make metric reproduction easier.
• Improved hybrid search with heap-driven lazy expansion and global top-N competition. The 1.1.1 benchmark package reports stable LoCoMo targets around 91% for hybrid search and 93% for agentic search.
• Synced the 1.1.1 source package while preserving GitHub-only workflows, templates, contributor-doc checks, public release support, use-case material, and the existing English README.md structure.
• Expanded CI coverage to Python 3.12 and 3.13, refreshed package metadata, and kept docs/OpenAPI checks in the release flow.
• Updated quickstart, benchmark, Chinese README, docs index, and cross-document references for the current setup and benchmark workflow.

Fixes

• Fixed concurrent Knowledge cascade upserts by switching to an atomic INSERT ... ON CONFLICT DO UPDATE path.
• Kept the OpenAPI application version in sync with package metadata instead of a hardcoded version.
• Fixed profile middleware so inner handler exceptions are re-raised instead of being swallowed.
• Reduced unnecessary LanceDB optimize() I/O by throttling cascade optimize calls.

Compatibility Notes

• Existing EverOS demo TUI and live demo changes remain preserved.
• Existing DashScope rerank provider support remains preserved.
• The English README.md keeps the GitHub main structure; release-package README changes were not applied to the default README.
• Existing local-first file:// URI handling remains allow-any by default. For server deployments, configure FILE_URI_ALLOW_DIRS explicitly to constrain readable file paths.
• GitLab/internal-only artifacts such as .gitlab/, .gitlab-ci.yml, .vscode/, .claude/skills/release/SKILL.md, and evaluation/ are not part of the GitHub release.

Upgrade Notes

• Run uv sync --frozen against the updated uv.lock.
• Use benchmarks/README.md and benchmarks/config.toml as the entrypoint for LoCoMo benchmark reproduction.
• Review updated config templates in src/everos/config/default.toml, src/everos/config/default_ome.toml, and src/everos/templates/env.template.
• Review CHANGELOG.md for the complete 1.1.1 changelog.

Verification

This release was checked with:

• make docs-check
• uv lock --check
• make lint
• uv run pytest tests/unit/test_scripts/test_check_github_contributor_docs.py -q
• PR #327 full CI: unit tests, integration tests, lint, links, package build, commit-message check, and PR-title check on Python 3.12 and 3.13

EverOS 1.1.0

EverOS 1.1.0

EverOS 1.1.0 expands the memory system beyond user episodes with first-class
knowledge management, reflection, and stronger operational guarantees around
search, persistence, and API contracts.

Highlights

• Added Knowledge APIs and storage for document creation, listing, patching,
  deletion, taxonomy handling, and knowledge-topic search.
• Added Reflection orchestration for periodically merging and refining episode
  clusters.
• Expanded OME runtime support with event IDs, run-record storage migration,
  configuration reload behavior, and testing harness improvements.
• Improved search and get behavior for agent-owned memory, including agent
  cases, agent skills, and owner-type isolation.
• Reworked API error handling around typed exception handlers and consistent
  error envelopes.
• Updated docs, OpenAPI schema, configuration examples, and test coverage for
  the 1.1.0 surface area.

Compatibility Notes

• Existing local TUI demo registration remains available.
• Existing DashScope rerank support is preserved; the DashScope provider file
  is not replaced by the 1.1.0 update.
• The release intentionally leaves directories outside the 1.1.0 update scope,
  including existing use-case and iOS demo material, untouched.
• Knowledge search requires configured embedding and rerank providers. Missing
  providers now fail explicitly with configuration errors rather than silently
  returning degraded results.

Upgrade Notes

• Regenerate or review docs/openapi.json after route or DTO changes.
• Run uv sync --frozen against the updated uv.lock.
• Review config.example.toml, src/everos/config/default.toml, and
  src/everos/config/default_ome.toml for new Knowledge and OME settings.
• If running e2e tests without live provider credentials, use dummy provider
  environment variables for startup-only checks; live vector and rerank paths
  remain behind slow/live markers.

Verification

This release was checked with:

• uv run ruff check .
• uv run pytest tests/unit
• uv run pytest tests/integration
• uv run lint-imports
• uv run pytest tests/e2e with dummy LLM and embedding environment variables
• Targeted search/get regression tests for agent and deprecated-filter handling

EverOS 1.0.1

Security

• Path-traversal hardening for caller-supplied identifiers. sender_id now carries the same path-safety guard as app_id / project_id: a character whitelist plus rejection of the . / .. tokens. The whitelist admits @ and + so email-style ids and plus-addressing still pass.
• Defense-in-depth write containment. MarkdownWriter now rejects any write target that resolves outside the configured memory root before reading, creating parent directories, or writing files. The API layer maps this backstop error to HTTP 400.

Documentation

• Add a multimodal usage guide and correct the multimodal error semantics after end-to-end verification.
• Document the upcoming Knowledge Wiki and idle/offline Reflection/Dreaming roadmap in the README and documentation set.
• Rename outdated algorithm-library references to everalgo across docs and code comments; no code identifiers changed.
• Fix accuracy drift found in a documentation audit; reflect the everalgo packages being published and the v1.0.0 stable status.

EverOS 1.0.0

Superseded: EverOS 1.0.1 is available with security hardening for caller-supplied identifiers and markdown write containment. See EverOS 1.0.1.

First public release of EverOS — a Markdown-first memory extraction framework for AI agents.

Added

• Markdown as source of truth: all memory persists as plain .md files you can open, edit, grep, and version with Git.
• Lightweight three-piece storage: Markdown, SQLite, and LanceDB. No external services required.
• Hybrid retrieval: BM25, vector, and scalar filtering in a single LanceDB query.
• Cascade index sync: editing a .md file triggers file-watcher based index sync.
• Dual-track memory for user memories and agent memories.
• CLI and FastAPI HTTP API, async-first throughout.
• Pluggable OpenAI-compatible providers for LLM, embedding, and rerank.
• Decoupled memory extraction algorithms via the standalone everalgo-* libraries.