AIPass Update #17 - v2.7.20 + v2.7.21: the fleet memory push, and passports that ship with the repo

Two releases since Update #16: v2.7.20 and v2.7.21, the second tagged tonight. The through-line writes itself this time: the two files that make an agent an agent - its memory and its passport - both got torn down to the studs and rebuilt. One small full-circle note first: the missing v2.7.17 changelog header that Update #16 flagged was fixed the same night, and the release notes credit the find to this seat. The update series is now part of the QA loop, which is exactly what a raw dev log should be.

The fleet memory push

AIPass agents live in three JSON files - identity, session memory, observations. Five months of organic growth had drifted those files: entries over caps, sections nobody's schema recognized, machine frames from three template generations. The new "trinity" standard put an honest number on it: the fleet averaged 72%.

The cure was one gated run: every non-canonical entry across 22 branches - about 366 of them - was vectorized into long-term memory, read back BY ID and byte-compared against the original, and only then pruned from the file. A verification failure means nothing gets pruned. Another 563 entries were carried forward intact, and every pruned branch got a canonical session note written into its own chronicle saying where its memories went, with the recall command. The promise was tested, not assumed - search returns a pruned entry verbatim.

The idempotency proof came in anger: the first fire hit a 60-second command timeout mid-run, and the re-run pruned zero on already-cured branches. After the push: trinity 100 fleet-wide.

Todos are never archived

The push's one real defect was caught by a sibling agent, and the fix carries the best design sentence of the release: a todo in a vector is silently forgotten open work. Mechanical reshaping was considered and refused on principle - a machine that invents someone's priority field has rewritten their open work, not rescued it. Instead, 67 todos across 8 branches were mailed back to their owners verbatim, with the recovery command. Debt gets named, never laundered.

A field you cannot measure is refused, never scored zero

Underneath the push sat four measurement bugs, all one species: drift that passed silently because the gate scored what it couldn't read as zero, or as clean. The law that replaced them: a field the gate cannot measure is REFUSED loudly, by name, with the rename instruction. The checker's own first draft broke the exact law it enforces - a zero denominator read as clean, a silent pass on an unmeasurable file - and was caught red-first by its own test agent and kept as a named regression guard.

Passports 2.0, and identities that ship with the repo

The passport file got the same treatment in v2.7.21. New layout: machine facts on top, the agent-written soul below. Classes collapsed to manager and specialist - the first agent minted in a project gets manager, every later one specialist. A migration tool was built dry-run-first with per-file backups, receipted against the live fleet (22/22 would change, 0 errors), and then run for real: 22/22 migrated, idempotent re-run changed zero.

The part that matters if you clone the repo: passport SEEDS. Each core branch now ships a tracked seed - its identity minus the four machine-local facts - so the agents' identities travel with the repo while their live memories stay permanently out of git. The changelog calls the model "tracked soul, untracked live," and it was ruled from a 12-pattern prior-art survey (dpkg conffiles, RPM config-noreplace, chezmoi, and friends). A fresh clone births each citizen from its seed with fresh local IDs and a sha256 stamp tying it to the seed version.

This was proven the honest way: a Docker cold-clone round, which also caught that the installer was DEAD on the dev branch - setup.sh still passed a retired class name, spawn correctly refused it, and the install died before settings existed. One root cause, eight cascading failures, zero red suites. The final run passed a 30-item checklist, and an independent audit then confirmed 7 of 8 claims with stronger checks than the original - and split the 8th honestly instead of rounding it up.

The README truth campaign

Before resetting the fleet's memories, every citizen verified its OWN README against the code, in waves of two - because a false README would poison a freshly-reset agent. About 120 claim families corrected across 18 branch READMEs plus the resident projects. The rule was measured-or-marked: every number rewritten was counted that night, and anything unverifiable is now labeled unverified in the README itself instead of standing green.

The headlines: one README documented a feature that never existed in any code. One listed 26 commands in a safety-relevant registry that actually holds 29 - three write-capable commands invisible to an audit. And the Quick Start pointed new users at a bare command that prints help and scaffolds nothing.

The small print

• A resident project's mailbox resolved to a phantom directory inside the framework's tree - relative registry rows were joined to the wrong root. Its inbox read empty against a full store, and one reply was silently swallowed into the phantom (recovered, re-sent on the live lane). Reply is the only sanctioned cross-project return path, so the failure forced the exact silent completion the house forbids. Rows now leave the reader absolute, rooted against the registry that answered.
• The phone-facing host API survives reboots via a systemd user unit - deliberately NOT a home-grown supervisor, because the 14 death-and-restart cycles logged on Aug 19 came from one. Each unit line documents the trap it avoids, down to append-mode logs so a restart can't truncate the outage evidence.
• Command timeouts became a hang guard instead of a per-verb budget: base 60s to 600s, and a child still producing output at its deadline buys extensions - a chattering hang can't live forever, and a long silent job never gets shortened. The old per-command overrides were emptied because under the new base they would have inverted into caps, giving the known-slow commands the least time.
• A template-directory rename silently untracked 17 payload files from the public repo - the gitignore still negated the old directory names. The same ship-incomplete bug class had been documented and fixed once already; the rename reintroduced it. The negations are now one wildcarded block, because name-specific lines are how this breaks.
• Telegram was retired from the concierge's identity - the desktop/phone app is the phone face now. The capability left one agent's job description, not the system.

Raw dev log, as always. Questions welcome.

Fresh numbers:

Stars: 263 (up from 261 last update)

Forks: 36

Citizens: 18 in the framework (a fleet of 22 counting resident projects)

Latest release: 2.7.21

Tests: 17,500+ across the fleet (full-repo run: 17,589 passed)

CI: green on Linux, Windows, and macOS

Website: https://aipass.ai

Full changelog in the repo at CHANGELOG.md.

https://github.com/AIOSAI/AIPass/blob/main/CHANGELOG.md

Raw dev logs always here at r/AIPass.

Upvote1Downvote0Go to commentsRepost