MemForge: Portable, agent-neutral persistent memory format for AI coding agents (v0.5.6)

MemForge v0. 5. 6: portable, agent-neutral persistent memory format for coding agents. This deposit anchors the v0. 5. 6 ship state. v0. 5. 6 is the current head of the v0. 5. x line; the spec snapshot (spec/VERSION) remains at 0. 5. 3 since v0. 5. 4 / v0. 5. 5 / v0. 5. 6 are reference-CLI patches with no normative spec change. The bundle ships the spec snapshot + the full reference-CLI artifacts (CHANGELOG, README, license, examples/). The v0. 5. 0 -> v0. 5. 6 sequence - v0. 5. 0 (2026-05-10): multi-identity team-scale memory + cryptographic attribution + WebSocket messaging substrate normative contract. Four-voice internal cross-family review panel pre-tag (architect + critic + commercial + threat-modeler). - v0. 5. 1: reference CLI under the unified memforge dispatcher (14 subcommands). Architect-only first-pass shipped; retrospective panel (critic + threat-modeler) was run after tag and surfaced two issues that drove v0. 5. 2. - v0. 5. 2: Unicode NFC normalization on signed envelopes (closes repudiation vector). File-create TOCTOU window in identity. py closed via OCREAT|OEXCL + atomic os. replace. Bounded seen-nonce set (MAY -> SHOULD). Native Windows support via NTFS ACL-based file restriction. - v0. 5. 3: closes 3 remaining v0. 5. x MAJORs (registry-layer cool-down enforcement, bounded revocation walk with subprocess cleanup, TOCTOU-safe read via ONOFOLLOW + post-open fstat). Pre-tag release-rigor panel (architect + critic + threat-modeler) ran on both spec delta and new code surface; panel surfaced 4 additional BLOCKER-class and 2 MAJOR-class findings (framing-injection in walkᵣevocationₛet, locale-bound Windows ACL denylist, Windows TOCTOU overpromise, file-list incompleteness in invariant 21, bounded-walk escape-hatch undefined, subprocess cleanup not mandated). All closed in the same commit that ships v0. 5. 3. - v0. 5. 4: reference-CLI bug fix on memory-audit. False-positive "Orphan pointer (no file) " integrity violations for MEMORY. md pointers targeting subfolder detail files. Fix downgrades to a HEALTH advisory when the file exists at the subfolder path; truly-missing pointers remain INTEGRITY violations. No spec change. - v0. 5. 5: docs-only patch. New "Pick your transport: git-only or WebSocket? " decision-framing section in docs/team-bootstrap. md. New "Commit hygiene + signed memforge: prefixes" section in docs/quickstart. md. No spec or code change. - v0. 5. 6: docs + examples patch. Adds the examples/ directory with drop-in scripts. Bash + PowerShell parity for the commit-msg hook (enforces memforge: prefix grammar for Tier 2 scoped paths) and auto-commit watcher (auto-commits memory. md writes; skips Tier 2 scoped paths). WebSocket scaffold in examples/websocket/ (config. example. yaml + Python relay-probe diagnostic + README naming this as scaffold, NOT a deployable relay). No spec or code change in src/. Important: release-rigor framing Every release in the v0. 5. x line ran an internal multi-voice review panel pre-tag (architect + critic + threat-modeler, sized to the patch scope). Findings surfaced by the panel were addressed before tag. This is an internal review pass; it is NOT a substitute for independent red-teaming, third-party pentest, or formal security audit. No external security audit has been performed on this release. Residuals tracked in known-limitations. md reflect the internal panel's review scope. Reference implementation (PyPI package ildan-memforge==0. 5. 6) - 14 CLI subcommands under a single memforge dispatcher (shipped v0. 5. 1, unchanged surface through v0. 5. 6; underlying ₛecurity + revocation + registry layers tightened across v0. 5. 2 / v0. 5. 3). - Cross-platform secure-file abstraction at memforge. ₛecurity (POSIX mode bits + Windows ACLs via icacls + SDDL parsing, SID-based). - 233 tests pass on CI matrix ubuntu + macos + windows x Python 3. 10 / 3. 11 / 3. 12 (2 GPG-gated tests skipped without secret material). Bundle contents - SPEC. md (specᵥersion 0. 5. 3; unchanged through the v0. 5. x patches) - VERSION (spec version file; 0. 5. 3) - taxonomy. yaml- v0. 5. 6-known-limitations. md (living-doc snapshot at v0. 5. 6) - CHANGELOG. md (full history v0. 3. 0 through v0. 5. 6) - LICENSE (Apache-2. 0) - README. md- examples/ — drop-in scripts (commit-msg hook bash + PowerShell, auto-commit watcher bash + PowerShell, WebSocket scaffold: config example + Python relay-probe + README) Defensive-publication context This is one of three timestamped third-party anchors for the MemForge spec text (Channel 1: Software Heritage SWHID; Channel 2: this Zenodo deposit; Channel 3: GitHub release tags). v0. 5. 1 / v0. 5. 2 were skipped in the Zenodo channel by maintainer decision; v0. 5. 3 was the first end-to-end-baked release deposited (DOI 10. 5281/zenodo. 20114965). v0. 5. 4 / v0. 5. 5 were intended to remain Channel-3-only per the patch-no-Zenodo cadence rule; v0. 5. 6 mints a fresh Zenodo version because the examples/ directory is canonical operator-side surface worth anchoring alongside the spec. v0. 5. 0 deposit at DOI 10. 5281/zenodo. 20113964 is the historical v0. 5. 0 spec snapshot anchor. Install pip install ildan-memforge Source code + spec history https: //github. com/ildan-ai/memforge https: //github. com/ildan-ai/memforge/releases/tag/v0. 5. 6 License: Apache-2. 0