v0.6.3 migration and integrity notes¶

The Node package now installs native binaries for its supported platforms. The separate holographic-memory-mcp package remains the MCP launcher. Go, .NET, Java, Kotlin, Swift, and WebAssembly bindings exist in source but do not yet have published language packages or native release bundles; follow their runtime guides for local builds.

Storage recovery¶

Recovery refuses a journal with CRC-valid frames after a log end. This includes legacy v0.6.1 stores left with a zero header followed by stale valid frames after earlier corruption. Restore a known-good snapshot or re-encode the source data. A torn append with only a trailing end marker remains recoverable.

Provenance integrity¶

• A provenance status list or log read error other than not-found now prevents opening the store instead of treating credentials as unrevoked. Creating, deleting, or rotating provenance returns an error if the log cannot be written and synced.
• Batch Merkle trees use RFC 6962 domain separation. The batch envelope signs a versioned CBOR claim with its type, version, size, and root instead of a bare root. Previously signed bare-root batches still verify with the old hashing, but only together with their credential.
• Verification binds signatures to their records: the fact claim, inclusion proof, credential, signer, and record content must agree. Pasted signatures from another fact, deletion, key rotation, or log head no longer verify. Results include record_binding detail.
• verify_record reports revocation from trusted status lists and says when none was available. A rotated key signs the new log head, so integrity verification works immediately and after reopening with that key.
• Concurrent writes to one fact id update live records in log order. The chain head advances only after lines are written and synced, and a torn append is truncated. Revocation status lists and signed log heads are replaced atomically so a crash cannot expose a short list that reads revoked credentials as valid.