Skip to content

v0.3.0 - Durable Memory and Standalone Operations

Release date: 2026-07-27

Corrobore v0.3.0 turns the previous authenticated graph-runtime baseline into a durable, independently deployable memory data plane. It adds a versioned high-level memory contract, completes the standalone-server operating model, delivers the certified Elastic-free OpenCTI single-node distribution slice, and adds coherent database lifecycle operations. Existing Cypher interfaces remain available as an advanced, separately authorized surface.

The release also adds a sanitized, redistributable report-to-STIX acceptance corpus that gates evidence-aware candidate import, licensed CTI validation, supported corrections, strict semantic export, duplicate replay, and byte-identical persistent restart. Corrobore does not parse PDF input: OCR and LLM extraction remain upstream concerns.

Highlights

Domain-neutral memory contract v1

  • Adds typed remember, relate, recall, update, forget, consolidate, and trace operations through the embedded engine and POST /v1/memory/operations.
  • Keeps workspace, actor, agent, session, permission, request, and correlation context outside untrusted operation payloads.
  • Requires idempotency keys for mutations and returns stable receipts only after the configured durability transition succeeds.
  • Bounds recall by items, depth, payload, cost, timeout, and supernode degree, with selection reasons, consumed budgets, completeness, and typed truncation outcomes.
  • Separates application forgetting from privileged regulatory erasure and keeps consolidation proposal/apply behavior policy-gated and non-destructive.
  • Publishes a domain-free conformance corpus shared by embedded and standalone adapters. No optional domain provider is required for the v1 journey.

Delivered by PR #79.

Production-oriented standalone server

  • Establishes corrobore server start as the supported service entry point, with validate-config, status, version, snapshot, restore, and index lifecycle commands.
  • Resolves configuration deterministically through CLI overrides, environment, TOML, and defaults, while redacting authentication and key material.
  • Enforces exclusive persistent-directory ownership, strict recovery, compatibility checks, bounded graceful shutdown, and final durability flush.
  • Requires bearer authentication, TLS, and protected operational endpoints for non-loopback binds; invalid certificates, keys, or unsafe combinations fail before the listener opens.
  • Adds distinct liveness/readiness, version/storage compatibility, metrics, request correlation, structured logs, and actionable exit codes.
  • Ships native archives for Linux, macOS, and Windows and a production container using the same foreground standalone command.

This completes the standalone-server epic #13, delivered through PRs #25-#36 and recorded in its acceptance matrix.

Elastic-free OpenCTI single-node distribution

  • Adds a lossless OpenCTI-to-Corrobore graph model, a knowledge-data provider boundary, and a WAL-backed canonical paged store.
  • Covers durable snapshot synchronization, shadow-read parity, progressive read routing with automatic rollback, transactional writes, bounded backpressure, merge/deduplication, and durable reference projection.
  • Adds access-aware full-text and file-content search, advanced filters, cursor pagination, aggregations, and graph-operation parity.
  • Ships a seven-service single-node distribution without Elasticsearch or OpenSearch, plus migration, acceptance, upgrade, rollback, and operational evidence.
  • Keeps authorization filters inside query planning and result shaping so content, identifiers, topology, counts, ordering, cursors, and timing-visible outcomes do not weaken the caller's access boundary.

The distribution milestone is tracked by issue #54, delivered through PRs #55-#76, and documented in the Elastic-free acceptance matrix.

Storage lifecycle and recovery

  • Creates coherent online and offline snapshots under the canonical write barrier, with component checksums, WAL/checkpoint continuity, storage format, key identity, and retention metadata.
  • Validates and restores only into missing or empty targets before they become writable.
  • Exports snapshots to S3-compatible and MinIO storage using bounded streaming and protected environment credentials.
  • Rebuilds derived indexes deterministically from canonical data and exposes bounded operation status.

Delivered by PR #73.

Documentation and project identity

  • Groups Embedded, HTTP, and Standalone material under one Deployment Modes navigation while preserving existing page URLs.
  • Updates repository and documentation ownership from Noetance to Estance-Labs and records the completed Estance rebrand.
  • Adds durable acceptance pages for standalone and Elastic-free OpenCTI delivery, together with stricter docs-contract validation.

See PR #68, PR #78, and PR #81.

Contracts

API and compatibility

  • The high-level memory compatibility key is contract_version: "v1" for both Rust and JSON callers.
  • Existing authenticated /v1/cypher/read and /v1/cypher/write routes remain available. A relationship-mutation parameter binding defect is fixed by PR #31.
  • Unknown memory operations and unknown request fields are rejected. Clients should tolerate new optional v1 response fields and bounded outcome strings.
  • Advanced Cypher remains a separate capability and is not required by the high-level memory contract.

Persistence and operations

  • The supported storage compatibility remains manifest version V1 and record format JsonLinesV1; startup rejects unsupported or corrupt durable state before exposing a writable service.
  • Acknowledged memory mutations cross the configured persistence and fsync gate before success is returned.
  • Snapshot and restore are operational recovery primitives, not a substitute for an externally managed encrypted backup, retention, and restore-exercise policy.

Security

  • Non-loopback standalone listeners must use TLS, bearer authentication, and authenticated operational endpoints.
  • Trusted memory context cannot be overridden by operation JSON.
  • Hidden workspace targets use the same not-found surface as absent targets.
  • Default diagnostics, logs, metrics, manifests, and status output exclude credentials and customer memory content.

Release artifacts

The v0.3.0 tag builds and tests:

  • standalone archives for Linux x64/arm64, macOS x64/arm64, and Windows x64;
  • the corrobore and corrobore-ingest binaries with SHA-256 checksums;
  • the Elastic-free OpenCTI distribution archive and checksum;
  • a multi-architecture ghcr.io/estance-labs/corrobore:v0.3.0 image after its production-image smoke test passes.

Upgrade notes

From v0.2.2

  1. Back up the persistent data directory and validate the backup before upgrading. Do not copy a live directory outside the snapshot/write barrier.
  2. Validate the target configuration with corrobore server validate-config --config <path> before replacing a running service.
  3. For non-loopback deployments, configure TLS certificate/key files, required bearer authentication, and authenticated operational endpoints before startup.
  4. Stop the old process cleanly and verify it released exclusive ownership of the persistent directory. Never run v0.2.2 and v0.3.0 against the same directory concurrently.
  5. Start v0.3.0, then verify /health/live, /health/ready, /version, storage compatibility, metrics, and a read-only application probe before restoring traffic.
  6. Retain the previous binary/image and a verified pre-upgrade snapshot until application acceptance passes. Follow the documented rollback procedure if readiness, compatibility, authorization, or persistence checks fail.

The memory API is additive. Existing Cypher clients do not need to migrate to the seven high-level operations as part of this upgrade. New memory clients must send contract_version: "v1"; mutation clients must also provide stable idempotency keys.

Project links and automation should now use the Estance-Labs/corrobore repository and ghcr.io/estance-labs/corrobore image namespace.

Known boundaries

  • Corrobore v0.3.0 is the memory data-plane runtime. It does not include the Estance Cloud tenant gateway, SaaS control plane, billing, or customer console.
  • The high-level memory contract is domain-neutral. Hosted embedding/LLM inference and automatic model-authored consolidation are not included.
  • Application forgetting does not perform regulatory erasure across external backups, exports, replicas, caches, or tenant keys.
  • The Elastic-free single-node distribution milestone is complete, while the broader OpenCTI product epic #37 remains open for its remaining real-case delivery evidence.
  • The published medium OpenCTI profile remains conditional on its declared performance gate; the certified small profile is the default single-node baseline.

Validation and provenance

Release preparation is accepted only after the following pass on the merged release commit:

  • release-note and documentation contract tests;
  • strict MkDocs build;
  • Rust formatting, workspace build/check, Clippy, and complete workspace tests;
  • standalone and Elastic-free acceptance workflows required by the repository;
  • release workflow builds on every supported platform and verifies reported version/revision metadata before publishing artifacts.

The release tag must identify the exact merged commit and the GitHub release must retain its generated binary and distribution checksums.

Full comparison

See every merged change in v0.2.2...v0.3.0.