Release v3.4.0 — promote develop to main

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "mempalace",
       "source": "./.claude-plugin",
       "description": "AI memory system — mine projects and conversations into a searchable palace. 19 MCP tools, auto-save hooks, guided setup.",
-      "version": "3.3.6",
+      "version": "3.4.0",
       "author": {
         "name": "milla-jovovich"
       }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mempalace",
-  "version": "3.3.6",
+  "version": "3.4.0",
   "description": "Give your AI a memory — mine projects and conversations into a searchable palace. 19 MCP tools, auto-save hooks, and guided setup.",
   "author": {
     "name": "milla-jovovich"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mempalace",
-  "version": "3.3.6",
+  "version": "3.4.0",
   "description": "Give your AI a memory — mine projects and conversations into a searchable palace. 19 MCP tools, auto-save hooks, and guided setup.",
   "author": {
     "name": "milla-jovovich"

.dockerignore

@@ -0,0 +1,55 @@
+# Keep the build context lean — only what `uv sync` + the package need.
+
+# VCS
+.git/
+.gitignore
+
+# Python build artifacts / caches
+*.egg-info/
+dist/
+build/
+__pycache__/
+*.pyc
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+htmlcov/
+.coverage
+coverage.xml
+
+# Virtual environments (rebuilt inside the image)
+.venv/
+venv/
+
+# Local config / secrets
+.env
+.env.*
+.envrc
+mempal.yaml
+
+# Editor / OS cruft
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+.DS_Store
+Thumbs.db
+
+# Repo material not needed at runtime
+.devcontainer/
+.github/
+.agents/
+.claude/
+.codex/
+.codex-plugin/
+.claude-plugin/
+benchmarks/
+docs/
+website/
+landing/
+assets/
+examples/
+tests/
+*.md
+!README.md

.github/workflows/docker-publish.yml

@@ -0,0 +1,95 @@
+name: Docker
+
+on:
+  push:
+    # `main` is the release branch: pushes here publish the released image and
+    # update `latest`; `v*` tags publish versioned images. develop does not
+    # publish — it is validated via the pull_request trigger below.
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main, develop]
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v6
+
+      # Needed for the emulated linux/arm64 build on real pushes.
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Only authenticate + push for in-repo events. Fork PRs lack the
+      # packages:write token, so they build (to validate the Dockerfile) but
+      # do not push.
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          # latest -> main (the latest release); semver tags -> released versions.
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          # Publish multi-arch (amd64 + arm64 for Apple Silicon / ARM hosts) on
+          # real pushes; keep PRs amd64-only so the emulated arm64 build does not
+          # slow the PR check.
+          platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          # Fork PRs get a read-only Actions cache, so writing it just emits 403
+          # noise — only export cache on in-repo events.
+          cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max' || '' }}
+
+  # Build-only validation for the CUDA image so it cannot silently rot (CUDA base
+  # tag drift, cross-stage interpreter/venv copy paths, the `gpu` extra). The
+  # runner has no GPU, so this only proves the image *compiles*; it is never
+  # published (users build it themselves, per the README).
+  build-gpu:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build GPU image (validation only — not published)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile.gpu
+          platforms: linux/amd64
+          push: false
+          cache-from: type=gha,scope=gpu
+          cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=gpu' || '' }}

.github/workflows/publish.yml

@@ -0,0 +1,124 @@
+name: Publish to PyPI
+
+# Publishes mempalace to PyPI via Trusted Publishing (OIDC — no stored token).
+#
+# Triggers:
+#   * release: published — the normal path (drafting + publishing a GitHub
+#     Release fires this).
+#   * workflow_dispatch — a manual escape hatch. GitHub does not reliably emit
+#     a `release` event when a *draft* tied to a pre-existing tag is published,
+#     so this lets a maintainer run the publish for any existing tag from the
+#     Actions tab ("Run workflow" → enter the tag, e.g. v3.4.0).
+#
+# Build + publish run in ONE job on purpose: a two-job split hands the wheel
+# between jobs via upload/download-artifact, which failed repeatedly with
+# `BlobNotFound` on the same-run download. Building and publishing in the same
+# job removes that handoff entirely. The job is gated by the `pypi` environment
+# (manual approval), and the checks below keep it self-contained — it never
+# uploads a tag that isn't on main or doesn't match the version manifest.
+#
+# One-time setup required before the first run (see docs/RELEASING.md):
+#   1. PyPI → Manage project `mempalace` → Publishing → Add a trusted publisher:
+#        Owner: MemPalace   Repository: mempalace
+#        Workflow: publish.yml   Environment: pypi
+#   2. GitHub → repo Settings → Environments → New environment `pypi`,
+#      add yourself as a Required reviewer (this is the manual approval gate).
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to build and publish (e.g. v3.4.0). Used when the release event didn't fire."
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Build + publish to PyPI
+    runs-on: ubuntu-latest
+    # The `pypi` environment gate (required reviewer) pauses the whole job until
+    # approved, and scopes the OIDC trust on the PyPI side.
+    environment:
+      name: pypi
+      url: https://pypi.org/p/mempalace
+    permissions:
+      contents: read # checkout
+      id-token: write # mint the short-lived OIDC token for Trusted Publishing
+    steps:
+      - name: Resolve the release tag
+        id: tag
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+        run: |
+          set -euo pipefail
+          tag="${RELEASE_TAG:-${INPUT_TAG:-}}"
+          if [[ -z "$tag" ]]; then
+            echo "::error::no tag to publish — neither a release tag nor a workflow_dispatch input was provided"
+            exit 1
+          fi
+          # Validate the shape before it is ever used as a git ref (ref-injection
+          # guard): require vMAJOR.MINOR.PATCH with an optional -/+ suffix, so
+          # loose values like 'v3' or 'v3foo' are rejected.
+          re='^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$'
+          if [[ ! "$tag" =~ $re ]]; then
+            echo "::error::tag '$tag' is not a valid release tag (expected vMAJOR.MINOR.PATCH[-suffix])"
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "Resolved tag: $tag"
+
+      - uses: actions/checkout@v6
+        with:
+          # Fully-qualified refs/tags/ so an unqualified name can't resolve to a
+          # same-named *branch* instead of the tag (checkout prefers branches).
+          # steps.tag.outputs.tag is format-validated above (ref-injection guard).
+          ref: refs/tags/${{ steps.tag.outputs.tag }}
+          fetch-depth: 0 # full history for the ancestry check
+
+      - name: Verify the tag is on main
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          tag_sha=$(git rev-parse HEAD) # the checked-out tag commit
+          main_sha=$(git rev-parse FETCH_HEAD)
+          if git merge-base --is-ancestor "$tag_sha" "$main_sha"; then
+            echo "Tag $TAG ($tag_sha) is reachable from main — OK."
+          else
+            echo "::error::tag $TAG is not an ancestor of main. Releases must be cut from main."
+            exit 1
+          fi
+
+      - name: Verify the tag matches the version manifest
+        env:
+          TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          set -euo pipefail
+          # version.py is the source of truth (per CLAUDE.md); version-guard.yml
+          # separately enforces that pyproject + the three plugin manifests agree.
+          py_version=$(grep -E '^__version__' mempalace/version.py | cut -d'"' -f2)
+          tag_version="${TAG#v}"
+          if [[ "$tag_version" != "$py_version" ]]; then
+            echo "::error::tag $TAG does not match mempalace/version.py ($py_version). Bump the version files before releasing."
+            exit 1
+          fi
+          echo "Tag $TAG matches manifest version $py_version — OK."
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1