SAGE v6.5.0

Encrypted Node-to-Node Communication

No plaintext memories on the wire. v6.5 completes the LAN hardening cycle with transport encryption for all SAGE quorum deployments.

Highlights

• TLS Everywhere — REST API serves HTTPS by default. Personal mode auto-generates self-signed certs on first boot. Quorum mode uses a per-quorum ECDSA P-256 CA distributed during quorum-init/quorum-join.
• CometBFT P2P Already Encrypted — Verified that CometBFT v0.38.15 encrypts all validator gossip via SecretConnection (X25519 DH + ChaCha20-Poly1305). Documented, not new, but now part of the security story.
• TLS Certificate Infrastructure — New internal/tlsca/ package with CA generation, node cert generation, TLS config builders. sage-gui cert-status CLI for monitoring expiry.
• TLS-Aware Clients — MCP server auto-detects HTTPS when certs exist. Go internal clients (seed, vault, mcp) use 3-tier fallback: SAGE_CA_CERT env → ~/.sage/certs/ → system CAs.
• Python SDK v6.1.0 — ca_cert parameter for TLS verification. Bug fix: ca_cert=False now correctly disables verification. 64 tests passing.
• Docker TLS — amid supports --tls-cert, --tls-key, --tls-ca flags. Production compose mounts cert volumes per node.

What Changed

• 36 files changed, +1,962 lines
• 20/20 integration tests on 4-validator Docker cluster
• 14 internal packages pass with race detector
• Also fixed: deploy/init.sql missing provider column, integration test RBAC domain conflicts, .dockerignore for faster Docker builds

Foundation for v7.0

Certificates include ExtKeyUsageClientAuth for future mTLS. Per-quorum CA model supports cross-quorum federation. Certificate rotation can be governance-proposal-driven.

Full Changelog: v6.0.0...v6.5.0

SAGE v6.0.0

SAGE v6.0.0

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• 2ea831d feat: add MCP governance tools and Python SDK governance methods
• aa9fd15 feat: v6.0 dynamic validator governance — zero-downtime validator set changes
• 9279e1f fix: resolve golangci-lint issues in governance code

SAGE v5.4.5

SAGE v5.4.5

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• aadb637 fix: add OLLAMA_URL and OLLAMA_MODEL env var support for Docker deployments

SAGE v5.4.4

SAGE v5.4.4

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• 34bca06 fix: enable empty blocks in single-node mode to prevent broadcast_tx_commit timeouts

SAGE v5.4.3

SAGE v5.4.3

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• caacdd3 fix: return empty arrays instead of null for empty query results

SAGE v5.4.2

SAGE v5.4.2

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• 5125e82 fix: thread agent nonce through tx codec and ABCI verification

SAGE v5.4.1

SAGE v5.4.1

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• 310a47d fix: add nonce to request signing to prevent sub-second replay collisions

SAGE v5.4.0

What's New

FTS5 Full-Text Search Fallback

When Ollama is unavailable (Docker, air-gapped, no GPU), SAGE now falls back to SQLite FTS5 full-text search with BM25 ranking instead of meaningless hash-based cosine similarity. sage_recall and sage_turn automatically detect the embedding mode and route through the right search engine.

• Semantic() bool on Provider interface — hash returns false, Ollama returns true
• FTS5 virtual table (memories_fts) with porter stemming for intelligent word matching
• POST /v1/memory/search — text-based search with same RBAC/access control as /v1/memory/query
• GET /v1/embed/info — returns embedding provider metadata so clients can detect the mode
• Vault-safe: FTS5 indexing is skipped when encryption is active

Docker Compose for sage-gui + Ollama

New docker-compose.sage-gui.yml at project root — a single-node deployment with Ollama sidecar that pulls nomic-embed-text on first start:

docker compose -f docker-compose.sage-gui.yml up -d

Also adds SAGE_EMBEDDING_PROVIDER env var override so Docker users can switch to Ollama without mounting a config file.

Full Changelog

• 15 files changed, 589 insertions, 73 deletions
• All 17 test packages pass with -race

SAGE v5.3.2

SAGE v5.3.2

Sovereign Agent Governed Experience — persistent, governed memory for AI agents.

Quick Start (sage-gui)

# Download and extract for your platform, then:
./sage-gui setup    # Interactive setup wizard
./sage-gui serve    # Start your personal memory node

See the README for full documentation.

Changelog

• dd5fe04 fix: serialize all SQLite writes through writeMu to prevent SQLITE_BUSY

SAGE v5.3.1

Bug Fixes

• CometBFT height deserialization — broadcast_tx_commit response returns block height as a JSON string ("6294"), but the Go struct expected int64. This caused json: cannot unmarshal string into Go struct field .result.height of type int64 and HTTP 500 on all /v1/memory/submit calls. Fixed with json:",string" tag.

• SQLite write contention — Added write mutex to SQLiteStore.RunInTx to serialize write transactions at the Go level. SQLite's _busy_timeout doesn't reliably handle concurrent DEFERRED transactions that both escalate to write locks, resulting in SQLITE_BUSY errors during ABCI Commit flushes.

Files Changed

• api/rest/memory_handler.go — height field tag fix
• internal/store/sqlite.go — write mutex on RunInTx
• api/rest/handlers_test.go — test mock now returns height as string