chore(release): prepare Cortex 4.24.0 - #987

What merging this does

The merge is the release trigger: the tag job of the Pipeline pushes v4.24.0 on the tested merge commit, and release.yml then publishes the GitHub Release, the wheel and sdist with attestation, the SBOM, the .mcpb, PyPI (hypermnesia-mcp) and the MCP registry entry. The last tag is v4.23.5 (2026-09-23). The published advisory GHSA-7848-qh48-mx2w names 4.24.0 as its fixed version.

Version sites

pyproject.toml and the 17 sites scripts/check_version_surfaces.py checks: package.json, package-lock.json (2), server.json (2), manifest.json, gemini-extension.json, .claude-plugin/plugin.json, .claude-plugin/marketplace.json (metadata.version and the primary entry), plugins/hypermnesia-mcp-codex/.codex-plugin/plugin.json, assets/badge-version.svg (4), the README badge alt text, and this package's entry in uv.lock (by hand, as in #641). CHANGELOG.md: [Unreleased] → ## [4.24.0] - 2026-11-11, entries untouched.

tests_py/scripts/test_codex_runtime.py carried the version as a literal in three places and failed after the bump; they are updated. Neither the version-surface script nor #641 covers that file.

Third-party pins of the cortex-plugins marketplace

Both shas are the commits the annotated tags point to (ls-remote --tags origin '<tag>^{}'). The zetetic pin was three releases behind: 2.43.0 to 2.45.1 never reached users of this marketplace. Its description is rewritten from the plugin's own manifest at the v2.45.1 tag. zetetic 2.46.0 is not released yet; a later Cortex release pins it.

Behaviour changes for users

Security

• GHSA-7848-qh48-mx2w. remember, seed_project, ingest_prd and ingest_document refuse a domain or directory that belongs to another known project. The local override is CORTEX_CROSS_PROJECT_WRITES=<domain>,… or *; no tool argument reopens it. Explicit is_global=true needs CORTEX_CROSS_PROJECT_WRITES=*. anchor, supersedes_id, curation merges and replica refreshes no longer change another project's rows.
• Prospective triggers fire only in a session of their own project. create_trigger stores the session's project when no directory is given and refuses one reaching another project. A trigger stored without a directory no longer fires.
• GHSA-5w3v-7v7h-q9x4. record_session_end no longer writes an ADR task record outside the wiki root.
• GHSA-pw64-v3mg-xxmm. The Codex apply_patch hook refuses paths outside the working directory.
• Python 3.11 or newer is required (Pillow ≥ 13.0.0).
• The embedding model loads only *.safetensors; pickled checkpoints are refused.
• ADR-1112: personal data is stored owner-only (files 0600, directories 0700); existing installs are tightened once. ADR-1111: a hard forget erases every stored copy. ADR-1110: one redaction gate on every write into storage.

Install and runtime

• ADR-1108: no hook installs dependencies any more; run claude --init-only after claude plugin install and after claude plugin update.
• ADR-1114: the Claude Code plugin runs its own PostgreSQL 18.6.0 + pgvector 0.8.7 server, set up by claude --init-only.
• A profile with no configuration connects to a local PostgreSQL it was never configured for #704: no PostgreSQL URL is assumed. DATABASE_URL defaults to empty, auto with no URL is SQLite, and an explicit postgresql backend with no URL raises.
• ADR-1092: uv.lock is the only dependency source; the requirements/*.txt exports are gone.

Recall and tools

• Automatic injection finds the target 60 percent of the time against 97 percent for recall, and default recall hides user memories by tag #706: a user's own tags no longer hide a memory from default recall. Exact duplicates are stored again although the README says duplicates are merged #707: exact remember replays return the existing id within the same write scope.
• fix: avoid silently remapping explicit domain identities through substring collisions #721: query_methodology, validate_memory, assess_coverage, drill_down, get_project_story, narrative and recall_hierarchical read the domain remember writes. fix: bootstrap cognitive profiles from supported Codex conversation history #726: rebuild_profiles reads Codex history too.
• ADR-1113: per-project export/import (python -m mcp_server.portability). feat: provide a verified portable backup and restore journey for local memory #731: staged backup and restore.

Also in this pull request

ruff check . and ruff format --check ., the commands CLAUDE.md documents, were not clean on main with the pinned ruff 0.17.3: 9 E501 in four files and 7 files to reformat. No CI job enforces ruff (CONTRIBUTING.md:120), which is why it went unseen. Five over-long docstring or comment lines are wrapped and seven files reformatted, with no behaviour change. scripts/tests/test_no_main_comparison.py is excluded from ruff instead: it is delivered by render-ci, and a re-delivery would bring its findings back.

Benchmarks: not run

• CLAUDE.md:21: "Release-gate benchmarks: benchmarks/reproduce.sh, never against the live database."
• CHANGELOG.md:1117: "[Retiré 2026-10-29 : porte de non-régression contre main supprimée sur ordre de l'owner ; les benchmarks sont une mesure, pas une porte.]"

No benchmark was run for this release: no container runtime, datasets or models where it was prepared.

Checks

• check_version_surfaces.py: 17 sites agree with pyproject.toml. check_craftsmanship.py, check_doc_claims.py, check_project_wiki.py: OK.
• ruff check .: all checks passed. ruff format --check .: 4102 files already formatted.
• The 16 version, manifest, pins and touched test files: 297 passed, 283 subtests passed.
• tests_py without scripts and integration, on SQLite: 10097 passed, 18 failed, 474 skipped. The 18 are environmental: 17 need flashrank or sentence_transformers, which cannot be installed there, and one fails because the container runs as root. None touches a changed file.
• uv build --offline: wheel and sdist 4.24.0, Version: 4.24.0 in both. uv lock --check: OK.
• The MCPB step of release.yml on a scratch copy: manifest guard OK, bundle packed, server.json guard OK.

Known, stated plainly

• check_marketplace_pins.py exits 1 on this branch by construction: the self pin needs the tag v4.24.0. In a scratch clone with a local v4.24.0 tag it exits 0. The two third-party pins raise nothing.
• No CI job runs that script any more (marketplace-pins.yml no longer exists), and docs/agent-guidance.md:62-63 still says CI enforces it. That is how the zetetic pin went stale. Not changed here: the script needs the network and fails on any release pull request until the tag exists; it belongs in a scheduled or manifest-path workflow.
• Six tests of test_ci_mutation_scope.py fail outside CI on main as on this branch: their sandbox does not copy ci_mutation_lines.py, and the import succeeds only when the python3 on PATH has the editable install. They pass in CI. Not fixed in a release branch.

Not verified

• The whole tests_py/scripts directory was not rerun after the three-literal fix; the 16 related files were.
• PostgreSQL-gated tests, tests_py/integration, and the e2e, environment and install commands: this pull request's CI runs them.
• Whether the PyPI environment pypi waits for an approval.
• publish-ccplugins.yml listens to release: published and last fired for v4.13.1 (2026-07-12); it will probably need a manual dispatch.
• This is the first Cortex release through the deploy-key tag job; that the tag push starts release.yml is expected, not observed.
• The push reported 23 open Dependabot alerts on the default branch (1 critical, 7 high). They could not be read with the access available and were not examined.

Generated by Claude Code