rdmsm4x-changelog-20260924-1922-ecsmemory-1.1.0-hardening-deploy

ECSMemory (the fleet's shared memory: ecsmem0 behind every ~/bin/mem0-mcp, and the ecsmem0d HTTP daemon on 8767) was hardened to 1.1.0 and deployed on the hub.

Embedding requests keep the model warm with a smaller context.
Writes never store fake vectors.
/health is real.
Long-lived sessions see new memories.
The HTTP API requires a bearer token.
infer:true overwrites are recorded and atomic.
Daemon search went from no answer in 120 s under hub load to 0.84 s cold and 0.05 s warm.
The dead Python mem0/Qdrant stack (1.2 GB) was moved to an archive.

Written 2026-09-24 19:22 EDT on rdmsm4x by grok@rdmsm4x/ecsmem24 (Grok Bot; working over ssh from rdmbair15m5, builds on rdmbair13m5). Tickets ISSUE-20260924-27/28/29, SEC-20260924-02 (resolved); ISSUE-20260924-30 (handed off); TASK-20260924-15 (needs-decision); DEC-20260924-02, FEAT-20260924-13, TASK-20260924-16 (open). Covers 18:30–19:22 EDT.

Scope

Repos:
- lib/ECSMemory main: e9e594d, 47e8ce9, 53ab3cb (docs).
- apps/Tyrell branch grok/mem0-telemetry-ecsmem0d-ISSUE-20260924-30 @ aa610c4 (not merged).
Hub runtime:
- ecsmem0 and ecsmem0d binaries under lib/ECSMemory/.build/out/Products/Release.
- Managed ecsmem0d release and LaunchAgent plist.
- ~/.secrets/ecsmem0d.env (new).
- Mem0Local legacy dirs (moved).
Not touched:
- the signed Tyrell.app bundle, SelfBootstrap.swift, fleet_mcp_reconcile.zsh;
- Ollama.app;
- other agents' running sessions (they keep the old binary until restart).

Changes

What	Where	Evidence / undo
Embed requests send keep_alive "30m" and options.num_ctx 8192 (env ECSMEM_OLLAMA_KEEP_ALIVE / ECSMEM_OLLAMA_NUM_CTX)	ECSMemory OllamaClient	/api/ps: embedder ctx 40960, 11.74 GB, 5 min expiry → 8192, 6.78 GB, 30 min
Live-only embeddings for writes and search (Ollama failure = error, nothing stored). Real /health (Ollama reachability, embed model, measured latency, version/commit, auth). 501 structured-output retry without format	OllamaClient, MemoryPipeline, DaemonRouter	tests; /health status ok, ollama_probe_ms measured
Idle timer only during request read; server moved into library (honours --host, port 0 for tests)	HTTP/DaemonServer.swift	real-server test: 2.5 s embed vs 1 s idle passes
PRAGMA data_version freshness (incremental load + deletion reconcile)	MemoryPipeline, SQLiteMemoryStore	live: long-lived MCP session saw a CLI add and delete at 19:06
Bearer auth on 8767; CORS removed; DELETE needs "DELETE "; Host guard (421); non-loopback bind refused without token	DaemonRouter, BearerAuth, ecsmem0d main	401 none/wrong token, 200 with token, no ACAO, 421, 400
memory_history table; overwrite band 0.90; atomic dedup+write (AsyncMutex + BEGIN IMMEDIATE); single-query search without blobs; list filter before LIMIT; version from build (Mach-O section); per-request logs; embedding model+dim in ecsmem_meta	ECSMemory	tests 206/206 + 117/117 on rdmbair13m5 (baseline 184/184, 114/117)
Token file ECSMEM_AUTH_TOKEN (mode 600, value never printed)	rdmsm4x ~/.secrets/ecsmem0d.env	Undo: move the file aside, then restart the daemon. It then accepts only the legacy api-token
Hub ecsmem0 swapped atomically (1.0.0 → 1.1.0 47e8ce9, universal, sha256 25cec85e…)	~/dev/lib/ECSMemory/.build/out/Products/Release/ecsmem0 (→ ~/bin/mem0-mcp, ~/bin/ecsmem0)	Backup (hard link) ecsmem0.bak-20260924-v1.0.0-pre-hardening (ed7b490d…); ecsmem0d.bak-20260924-pre-hardening. Undo: `mv -f ecsmem0.bak-20260924-v1.0.0-pre-hardening ecsmem0`
ecsmem0d runs from managed path (ISSUE-20260923-06 rule): ~/Library/Application Support/Tyrell/bin/ecsmem0d → releases/ecsmem0d-47e8ce9b34ac/ecsmem0d. Plist ProgramArguments[0] changed; ProcessType Background → Adaptive; port/host unchanged	~/Library/LaunchAgents/com.eastcoastscience.ecsmem0d.plist	Backup ~/Library/Application Support/Tyrell/rollbacks/com.eastcoastscience.ecsmem0d.plist.bak-20260924-1907-pre-ecsmem0d-1.1.0. Undo: `launchctl bootout gui/501/com.eastcoastscience.ecsmem0d; cp -p <backup> ~/Library/LaunchAgents/com.eastcoastscience.ecsmem0d.plist; launchctl bootstrap gui/501 ~/Library/LaunchAgents/com.eastcoastscience.ecsmem0d.plist`
Legacy Mem0Local bridge-venvs, backups, qdrant, releases, current, mem0, history, logs, config-backups MOVED (1.2 GB)	→ ~/dev/archive/mem0local-python-qdrant-retired-20260924/	MANIFEST.md there with undo mv lines; config/ and ecsmem0.db* kept
Tyrell dashboard reads /v1/telemetry; health decode tolerates a missing service; token from ~/.secrets	apps/Tyrell branch aa610c4 (not merged, needs signed build)	Mem0 tests 42/42. Full suite: 996 Swift Testing passed; XCTest 415 (1 host-dependent failure testTailscaleJSONParsing on rdmbair13m5, untouched module) + 11 + 184
Design: thin `ecsmem0 mcp` over ecsmem0d + tailnet access for spokes	lib/ECSMemory docs/design/thin-client-and-tailnet-transport-2026-09-24.md	FEAT-20260924-13; not deployed (Rich decision)

Measurements (hub, rdmsm4x)

Daemon search, before:
- 18:35–18:41, load 330–496: 3/3 gave no response within 120 s; /health gave no response within 20 s.
- 15:29, load ~105: cold 37.9 s with no response; warm 3.85 s.
Daemon search, after (19:09, load 388): cold 0.84 s (embed 838 ms), warm 0.054 s and 0.057 s; /health 48 ms.
- One /health probe at 19:19 (load 505) missed a 5 s timeout. The next three answered in 0.22–0.25 s.
CLI search: before, cold 1.16 s / warm 0.11 s; after, cold 0.91 s / warm 0.13 s.

Follow-ups / handoffs

Tyrell lead (ISSUE-20260924-30, TASK-20260924-16):
- merge aa610c4 and ship a signed build that bundles ECSMemory ≥ 47e8ce9, built with Scripts/build_release.zsh;
- in the plist writer, use ProcessType Standard (Adaptive boosts only on XPC) and drop Nice 15/LowPriorityIO;
- decide managed vs Helpers path;
- retire the legacy api-token after the ship.
Web dashboard users: paste the token into localStorage key ecsmem0_token for list/search.
Rich:
- DEC-20260924-02 (the 5 synthetic canaries);
- FEAT-20260924-13 (transport/tailnet);
- optionally, global Ollama env.
Pre-existing, not fixed: at MCP exit, the TRUNCATE checkpoint can wait up to ~130 s under reader contention (observed more than 10 s once).
Apple Notes entry: not written; Notes doesn't run over ssh. Handed off via the bus.