Changelog
Release notes and version history for TRW. Track how the operating layer, memory engine, and delivery tooling evolved over time. This page covers shipped releases only, so it stays a reliable history instead of turning into a speculative roadmap.
Latest versions
1.0.5
trw-mcp
0.15.0
trw-memory
0.33.0
platform
v26.2_TRW
Framework
These are the in-repo development versions of each package, and they can sit several releases ahead of what is published. The installer (install.sh) and pip resolve the most recent release published to PyPI — that, not the numbers above, is what you actually get, and the release timeline below covers published releases only. Run pip index versions trw-mcp to see what is installable right now.
Releases
v1.0.52026-08-04
Review-Receipt Integrity + Three Fixes That Had Not Reached Anyone
trw-mcp 1.0.1–1.0.5
- A session could mint an "independent" review receipt for its own work. Reviewer-identity verification's run-claim branch checked only that the claimed run id differed from the delivering run's — never the session — while the sibling session-only branch beside it had always rejected the mirror image. Any session that had called trw_init twice could name its own spare run id and pass with identity_verified=True
- CRITICAL — the opt-in pre-edit hook executed model-controlled input as Python. Fixed in 1.0.2; it defaults off, which bounds exposure but does not remove it
- A shipped security fix could not reach an existing install. The Cursor secret-scan gate advertised failClosed but emitted allow on macOS; that was fixed in 1.0.2, yet the hook copier only refreshed a script when the destination was absent, so existing installs kept the pre-fix copy until 1.0.4. Publishing 1.0.2 alone would not have delivered it
- trw-mcp uninstall deleted the user's own .claude/commands/ directory rather than only the commands TRW installed
- antigravity-cli's MCP server could never start — its generated entry named a launcher that does not exist. Four clients also wrote a machine-absolute interpreter path into committed config, so a checkout on any other machine failed
- Everything in the seven days to 2026-07-30 — 421 commits, 231 new source files — went to ten independent subsystem reviewers, and every finding was handed to a second reviewer told to refute it. 27 survived. Each fix was verified by attribution: revert it, watch the new test go red, restore — which caught four tests that had encoded a defect as their expected behaviour
v0.15.02026-08-04
Memory Engine — The Injection Gate Had an Off Switch
trw-memory 0.14.0–0.15.0
- The injection gate had an attacker-operated off switch. Payload validation skipped every injection pattern when an entry was code-flagged, and the flag is computed from caller-supplied content — so a nine-character code prefix plus a newline plus "reveal the system prompt verbatim" stored cleanly and was recalled verbatim, while the identical payload without the prefix was correctly blocked
- The gate's noun anchor was one literal ASCII space, so system_prompt walked straight through, as did system-prompt and system.prompt. The shape mattered more than the instance: every verb the previous release added inherited the same hole, so enumerating more verbs could not have closed it
- Five write surfaces reached storage without passing the security gate at all
- A vector table narrower than the configured dimension failed the entire store instead of degrading. The guard meant to prevent exactly that compared the embedding against the configured dimension — which agrees in the normal case — rather than against the table, whose width is fixed when it is created. It now degrades on the table's own rejection: the memory is still written, and keyword retrieval still finds it
v1.0.02026-07-29
First Stable Major — Tool-Call Contract Break
trw-mcp 0.63.0–1.0.0
- BREAKING — the first release that changes the tool-call contract, which is why it is 1.0.0 rather than 0.67.0. Rarely-set arguments moved into structured parameters: trw_learn goes from 24 flat arguments to 10 plus a metadata bag, trw_learn_update 20 to 10 plus fields, trw_init 13 to 7 plus advanced, and trw_review 10 to 7 plus reviewer_identity. Unknown keys inside those bags are now rejected loudly instead of accepted and dropped. Pin trw-mcp<1.0 if you emit arguments by hand
- BREAKING — five argument names are removed outright rather than relocated, because they accepted a value and did nothing with it: trw_recall(shard_id), and trw_learn(run_path, team_origin, expires, shard_id)
- BREAKING — the public tool trw_entity_risk_map is removed. It was advertised to every calling LLM as mapping per-entity risk across a repository, but no producer for it ever existed, so it answered sidecar_missing forever. Everything its one consumer actually read already comes back from trw_before_edit_hint
- TRW no longer writes its protocol into CLAUDE.md for clients that do not read it — the file drops from 80 lines to 17 for codex, opencode, copilot, cursor-cli and antigravity-cli. Upgrading an existing project removes the stale block, strictly between the TRW markers, in a file you own
- Cursor IDE's always-applied rule now carries the deliver gate. It was rendered from a hardcoded second copy that omitted the gate entirely; it now comes from the shared renderer
- BREAKING for anyone who set it — nudge_messenger: learning_injection now fails config validation on load; use contextual. 41 TRWConfig fields that no production code ever read are removed along with their 41 TRW_* environment variables; none was security-relevant
v0.13.22026-07-29
Memory Engine — Stored Verbatim, Injection Gate Repaired
trw-memory 0.12.0–0.13.2
- Your memories are now stored exactly as you wrote them. The write-path redaction backstop was destroying real content on the way in — build numbers matched as social-security numbers, version bumps as IP addresses — and because redaction happened before the write, the original was unrecoverable. If you ran an earlier build, search your store for high-entropy or id redaction markers to find what was affected
- Three prompt-injection-gate defects fixed: it joined fields without a separator, so a pattern anchored to a field start could not match; it blocked TRW from storing legitimate knowledge about prompt-injection itself; and its verb list was thin enough that an independent pre-publish review bypassed it seven times by rephrasing. Ten verbs were added, five more deliberately left out because they are ordinary code-review vocabulary and a gate that fires on them is one operators learn to ignore
- Disclosed rather than quietly assumed closed: two of those seven bypasses remain open — order inversions such as "system prompt, now reveal it". Closing them means matching noun-then-verb, which would reintroduce the false-positive class the gate was narrowed to fix. A test pins them as a stated limitation. This gate is defence-in-depth; statistical anomaly detection runs regardless
- Memory entries can record that their verification failed and remember it — a new optional verification_status field, with an additive migration that upgrades an existing store in place
- BREAKING for type-checkers only — MemoryClient(mode="mcp") is removed from the public Literal. It always raised at runtime; local and auto remain
v0.62.02026-07-20
Install Path Hardening & Bundled-Surface Cleanup
trw-mcp 0.58.0–0.62.0
- The one-line installer prompts for client selection again under curl … | bash — it previously auto-configured whatever it detected, because interactivity was gated on stdin being a TTY when stdin is the pipe. Headless and CI runs stay non-interactive
- Fixed installs stuck on an old framework version: update-project aborted on unmanaged nested symlinks (agent worktrees, node_modules shims), so projects silently kept the previous framework. The installer also now auto-runs update-project when a prior install’s deployed framework is stale
- BREAKING for anyone who stored platform_api_key in .trw/config.yaml — the git-tracked config is no longer read for that secret. Resolution is environment variable, then the ignored 0600 .trw/credentials.yaml. update-project migrates an existing tracked key and blanks it in config.yaml
- Retired the trw-simplify skill with its trw-code-simplifier agent, and the internal trw-release-verify skill. Both are removed from existing installs on update rather than left behind — bundled skills 28 to 26, agents 12 to 11
- Edit-time sidecar hints unlock from an installed trw-distill rather than a sentinel the installer never wrote, so entitled installs stopped being told to buy a tier on every edit. With trw-distill absent the hint tools now return nothing instead of a paid-tier upsell
v0.57.02026-07-18
Cross-Client Dispatch & Security Hardening
trw-mcp 0.57.0trw-memory 0.11.0
- Cross-client dispatch — hand a task to another coding CLI (Codex, Claude, opencode) for a background second-opinion audit, then read the result back with trw_dispatch and trw_dispatch_status
- BREAKING — trw-mcp now runs stdio-only. The shared HTTP MCP server, stdio proxy, and HTTP transport are removed, along with the --transport/--host/--port flags and the mcp_transport/mcp_host/mcp_port config fields (existing configs stay harmless; unknown keys are ignored). Each client spawns its own instance, so MCP tool changes take effect on the next reconnect instead of serving stale tool code
- Cross-client dispatch is sandboxed by default — a sanitized environment, per-client read-only enforcement, process-group tree-kill on timeout, prompt redaction, and working-directory write-confinement
- trw-memory now scans and redacts secrets and PII (including GitHub and AWS key patterns) from stored evidence, with a schema upgrade that runs behind a mandatory backup snapshot and never silently resets your data
- Leaner responses — the default trw_recall payload is about 65% smaller via a serialization-truthful token budget, with a verbose mode on demand
v0.55.02026-06-09
User-Space Memory Tier
trw-mcp 0.55.0trw-memory 0.9.0
- Opt-in user memory tier at ~/.trw — portable learnings follow you across every repo on the box instead of being relearned per project
- Scope routing: trw_learn classifies portability automatically, keeping repo-local gotchas with the project and cross-cutting knowledge box-wide
- Federated recall: trw_recall merges project and user tiers into one ranked result, with a cap so user hits never bury a precise project match
- Non-destructive by default — the tier is off until you opt in, and enabling it never moves or rewrites existing project learnings
v0.54.02026-06-08
Leaner Sessions & Resilient Recovery
trw-mcp 0.54.0trw-memory 0.8.5
- Compact-by-default session start: learnings cap to top-K and diagnostics collapse to a one-line health summary, with a verbose mode on demand
- Torn-log resilience: append-only run logs drop only a single corrupt line instead of failing the whole read after a concurrent write
- Build-check failure attribution: each test failure is tagged likely-yours, likely-pre-existing, or unknown for fast triage
- Intentional-code marker: deliberately counterintuitive code can be flagged so the bundled reviewer and simplifier agents leave it alone
- Tool surface trimmed to the tools in use, plus an installer device-auth fix so first-run login points at the real API host
v0.8.52026-05-29
trw-memory: Durability & Corruption Resilience
trw-memory 0.8.2–0.8.5
- Resilient reads quarantine a single bad row instead of collapsing an entire query, keeping degraded reads correct and bounded
- PII scanner hardening: GitHub PAT and AWS access-key patterns are now caught before they can be stored in plaintext
- Hybrid BM25 + dense + RRF retrieval ordering is preserved by default when the candidate pool is large enough, with per-branch latency telemetry
- Re-entrant transaction bracket collapses many writes into a single commit, removing per-row overhead on batch passes
- Linux-conditional native SQLite dependency with graceful stdlib fallback on macOS and Windows, keeping installs green
v0.48.x2026-05-28
Multi-Client Distill Channels & Stability Hardening
trw-mcp 0.48.0–0.48.15trw-memory 0.8.3
- Per-client write surfaces for Claude Code, Cursor, Codex, OpenCode, Copilot, and Antigravity CLI, activated automatically on install and update
- First-class, full-ceremony support for the Antigravity CLI profile with environment discovery, config deep-merge, and specialist subagents
- Feedback-submission redaction hardened: secrets, headers, metadata, and connection strings pass the redaction chokepoint before any network call
- Throttle, deadline, and watchdog controls eliminate a multi-minute learn stall, and several validation and sync paths are now bounded by repo size
- Capability-tier resolver maps the portable frontier/balanced/local vocabulary to each client, plus an in-IDE tool to submit feedback without leaving the editor
v0.47.02026-04-27
Governance & Multi-Client Support
trw-mcp 0.47.0trw-memory 0.8.1backend 0.16.2
- Boot-time security gating: every tool dispatch passes through one verified audit, telemetry, and kill-switch surface
- Eight first-class client profiles: Claude Code, Cursor IDE, Cursor CLI, Aider, Codex, Copilot, Gemini, OpenCode
- Tamper-evident memory: learnings are signed on write so storage-layer tampering is detectable across sessions
- Backend deploy hardening with structural packaging discovery and a dependency-drift gate
v0.46.02026-04-26
Memory Defense & Continuous Calibration
trw-mcp 0.46.0trw-memory 0.7.0
- Memory-poisoning defense in observe-mode: suspicious entries surface in a shadow partition before any enforcement
- Calibration window before promotion to enforce mode - no premature flips on unvalidated thresholds
- Canary entries auto-verify on recall to detect storage-layer tampering
- Batch memory writes with per-item recovery: one bad entry no longer fails the whole batch
v0.43.02026-04-23
frontier 4.7 Framework Calibration
trw-mcp 0.43.0–0.45.x
- Every prompt surface recalibrated for Claude frontier 4.7 - instruction style, default effort, and tokenizer behavior
- Client-profile-aware prompt rendering: no hardcoded CLI assumptions across the framework
- Tool and skill descriptions standardized to a consistent, model-friendly pattern
v0.42.02026-04-12
Instruction Accuracy & Tool Filtering
trw-mcp 0.42.0
- Instruction files now automatically filter to show only available tools, preventing agents from calling unavailable tools
- New CLI command to validate instruction accuracy against the active tool set
- Delivery gate warns when project instructions reference tools not available in the current configuration
v0.39.12026-04-02
OpenCode Release Hardening
trw-mcp 0.39.1
- OpenCode support release hardened with full-package verification
- Outcome-correlation writes now persist cleanly for SQLite-backed learnings
- Session-boundary and template-version regressions aligned to current runtime behavior
- Bundled OpenCode artifacts remain synchronized with source skills, hooks, and agents
v0.37.02026-03-31
Architecture & Optimization
trw-mcp 0.37.0trw-memory 0.6.2platform 0.27.0
- Configuration decomposition into focused domain modules
- Optimized tool responses — significant token reduction per call
- Agent consolidation to focused roles with clean upgrade path
- Instruction file optimization and reduced hook overhead
- Contextual learning injection on phase change
- Platform OAuth and authentication hardening with cold-start resilience
v0.36.02026-03-30
Codex Provider Support
trw-mcp 0.36.0
- Full Codex bootstrap: one command generates all project configs, instructions, and skill definitions with merge-safe updates
- Codex client profile: light-ceremony mode optimized for Codex's context constraints and workflow
- Skill path normalization: existing configs auto-corrected on update for consistent directory references
- Bootstrap stability: fixed edge case where project initialization could fail in certain directory layouts
v0.35.02026-03-29
Architecture & Code Quality Sprint
trw-mcp 0.35.0trw-memory 0.6.0
- Resolved critical architectural layering issues to enforce clean dependency boundaries across the codebase
- Major module decomposition: large modules split into focused, maintainable units across both packages
- Exception handling audit: all error handlers reviewed and justified, plus security fixes in bundled scripts
- trw-memory 0.6.0: improved CLI error handling, cleaner module organization, and a new abstract storage interface
v0.34.02026-03-28
Developer Experience Sprint
trw-mcp 0.34.0
- Embeddable server mode: MCP server can now be used as a library for testing and integration, with full type annotation support
- Config system refactored: large configuration module split into focused, maintainable components
- Import cycle cleanup: circular dependencies eliminated for faster startup and cleaner architecture
- New CLI commands: auto-generated config reference, project uninstall with dry-run mode, and --version flag
v0.33.02026-03-28
Session Resilience Hardening
trw-mcp 0.33.0
- Activity heartbeat: tool calls now signal liveness so long-running sessions are never incorrectly marked stale
- Database maintenance: proactive storage cleanup prevents unbounded growth during long sessions
- Reliable session boundaries: session start events are always recorded, ensuring delivery gates work regardless of tool call order
- Fixed multiple stale-run detection bugs: active sessions are now correctly identified and prior session data is properly isolated
v0.32.02026-03-26
Executable Assertions & Self-Verifying Memory
trw-mcp 0.32.0trw-memory 0.4.0
- Machine-verifiable assertions attached to memory entries — learnings auto-verify against your codebase to detect staleness
- Assertion-aware recall: entries with failing assertions are automatically deprioritized in search results
- Security-first verification: path traversal protection, pattern limits, and binary file detection
- Comprehensive test coverage across both packages for all new verification capabilities
v0.31.02026-03-25
Device Auth & One-Line Install
trw-mcp 0.31.0backend 0.15.0platform 0.26.0
- One-line install: a single shell command detects your environment, installs from PyPI, and configures your project
- Device authorization flow — authenticate your CLI via browser with QR code support
- OAuth social login with Google and GitHub, including Google One Tap for instant sign-in
- CLI auth commands: login, logout, and status with multi-organization support
v0.30.02026-03-25
Observation Masking & Source-Available Prep
trw-mcp 0.30.0
- Adaptive context budget: tool responses automatically compress as sessions grow longer, significantly reducing token costs
- Source-available publication prep: BSL 1.1 license, public README, secrets scrubbed
- Redundancy detection: repeated identical tool responses are automatically suppressed to save context
- Instruction cache invalidation on upgrade — version bumps force re-render across all projects
v0.27.02026-03-19
Framework v24.4 & Structured Logging
trw-mcp 0.27.0trw-memory 0.3.0
- Framework version bump to v24.4 — coordinated release across all packages
- Structured logging overhaul: consistent, queryable log events across all modules
- Expanded cross-package integration test suite covering end-to-end tool workflows
- Workstreams reliability fix — parallel agent work is properly preserved during cleanup
v0.22.02026-03-18
Client Profiles & Adaptive Ceremony
trw-mcp 0.22.0
- 8 built-in client profiles: claude-code, cursor-ide, cursor-cli, opencode, codex, copilot, gemini, and aider
- Profile-aware ceremony: process overhead adapts to each platform's context window and capabilities
- Response optimizer: tool responses automatically compacted for LLM context efficiency
- Multiple delivery reliability fixes and internal code quality improvements
v0.20.02026-03-15
Multi-Platform Support & Full Tool Suite
trw-mcp 0.20.0
- Multi-platform ceremony: full, light, and off modes — spans Claude Code, Cursor IDE, Cursor CLI, OpenCode, Codex, Copilot, Gemini, and Aider
- Complete orchestration toolkit: tools, resources, skills, and bundled agents for the full development lifecycle
- Learning injection: high-impact learnings auto-promote into instruction files for future sessions
- Installer UX overhaul with health checks and cross-platform server management
v0.15.02026-03-14
Workstreams Safety & Type System
trw-mcp 0.15.0
- Pre-spawn safety checks: agent creation blocked when uncommitted changes could cause conflicts
- Comprehensive type system: strong typing at all major cross-module boundaries for reliability
- Scoring accuracy improvements: calibrated weights and removed placeholder dimensions
- File ownership enforcement: prevents multiple agents from editing the same files simultaneously
v0.7.02026-03-14
Documentation Overhaul
platform 0.7.0
- Complete rewrite of all documentation pages with progressive disclosure and scannable layouts
- Expanded references covering the full tool, skill, and agent catalog
- SEO overhaul: structured data, custom social cards for key pages, and expanded sitemap
- Full API reference with endpoint docs, auth details, examples, and error formats
v0.5.02026-03-05
Interactive Memory Visualizations
platform 0.5.0
- Interactive memory dashboard: growth timeline, tier migration, smart search, knowledge graph, and forgetting curve visualizations
- Cross-widget interactions: search highlights matching data across dashboard sections
- Homepage growth timeline showing how framework knowledge compounds across tasks
v0.1.02026-02-27
trw-memory: Standalone Memory Engine
trw-memory 0.1.0
- Standalone persistent memory engine — purpose-built for AI coding agents with fast local storage
- Hybrid search combining sparse keyword and dense vector retrieval for high-quality recall
- Knowledge graph, tiered storage lifecycle, semantic dedup, and LLM-powered consolidation
- Integrations with popular AI frameworks: LangChain, LlamaIndex, CrewAI, and OpenAI-compatible APIs
Next steps
Use quickstart to confirm the current install and access flow, configuration to understand changed defaults, and the API reference when a release touches hosted platform behavior.