Zephr
Start free
Releases

Every changedocumented.

Real dates, real SHAs, and honest status labels. We ship what we can prove, mark what is still evolving, and never pretend a planned feature is already in production.

shipped·evolving·planned
All entries are derived from CHANGELOG.md and the release evidence ledger. No invented versions or fabricated SHAs.
Changelog

What we shipped, and what is still in motion.

Each release below is annotated with its status. Overlaps are intentional: the Unreleased section continues to collect work that has not yet been tagged as a stable release.

Unreleased
In developmentEvolving

Embedding model migration with dual-read re-indexing and score normalization. Silent-failure audit: lease-finalize errors, dual-read failures, search backend errors, LSP cleanup.

  • Embedding model migration with dual-read re-indexing and score normalization.
  • Silent-failure audit: lease-finalize errors, dual-read failures, search backend errors, LSP cleanup.
  • LSP MCP tool, Rust daemon Phase 1, and dashboard 8-phase product-family wiring.
Added
  • ZEP-273: Embedding model migration with dual-read re-indexing (cross-model migration mode, score normalization)
  • ZEP-273: Score normalization for dual-read search (min-max per-collection)
  • Silent-failure audit findings fixed: lease-finalize errors, dual-read failures, search backend errors, LSP process cleanup
  • LSP MCP tool: zephr_lsp with hover, refs, def, diagnostics actions
  • Adversarial test suites: continuity-format, admission, search
  • CLI lsp commands for local operator use
  • ZEP-389 Phase 1: Rust daemon store adapter, IPC transport, Node.js sidecar client
  • ZEP-389 Phase 1 CRITICAL fixes: schema mismatch, racy socket removal, task leak, JSON-RPC notification handling, IPC partial-read buffering
  • ZEP-387: Multi-admit search with worktree-scoped filtering
  • Dashboard: 8-phase product-family wiring (ZEP-398–406), RuntimeProvider, route smoke test, ErrorBoundary, MobileNav, Pagination
Fixed
  • Validate test envelope rootHash recomputation (validate.test.ts)
  • CLI search --worktree guard (returns error 64 when missing)
  • TypeScript index-signature errors in ipc-client.ts
  • L1-corpus capacity_exceeded regression (admittedWorktreeId after bootstrap)
  • a11y WCAG AA contrast fix (rail link color)
Security
  • Path traversal protection added to CLI lsp commands
  • Admission scope checks added to CLI grep/search commands
  • Hostile-promise species/constructor trap hardening in local gateway
  • Bootstrap session one-use TTL with revocation + POST exchange for session cookie
  • Origin/binding revalidation in local gateway after session exchange
  • Relative-import guard in local gateway
V1 Beta · e23d4d5a
2026-07-23Shipped

All four major tracks merged to main at e23d4d5a — Continuity Format v1, multi-project identity, live operator console, Cursor/Codex adapters. Ultra-security review PASS (brisk-indigo-badger): no blocker/high/medium vulns, all approved-controls preserved.

  • All four major tracks merged to main at e23d4d5a — Continuity Format v1, multi-project identity, live operator console, Cursor/Codex adapters.
  • Ultra-security review PASS (brisk-indigo-badger): no blocker/high/medium vulns, all approved-controls preserved.
  • Conditional beta GO gated on green CI+security at one SHA and TrustBench evidence artifacts.
Added
  • Continuity Format v1 reference implementation (33 source files in packages/continuity-format)
  • Multi-project identity foundation: migration 0016, project_name routing, CLI commands
  • Live operator console (apps/local-ui, 10 source files) replaces fixture-only console
  • Cursor adapter package (81 lines) — consented MCP configuration, no private-data scraping
  • Codex adapter package (77 lines) — first-party adapter lifecycle and receipt integration
  • Adversarial crash-resilience and degradation test suites
  • CLI lifecycle commands: install, upgrade, assess, key-check, health, snapshot, uninstall readiness/complete
  • Public benchmark page at /benchmark
Merged tracks
  • ZEP-377 Phase 0-5: authenticated import/handoff/DB persistence/host importer/adapter receipt
  • ZEP-375 Stage 1-6: descriptor-safe sanitizer/connection authority/Cursor/Codex adapter lifecycle/receipt integration + adversarial/revocation coverage
  • ZEP-251 Phase 1-7: lifecycle commands, negative-path CI gate, backup integrity + crash recovery
  • ZEP-20 Phase 2: migration controller lifecycle, 22 source files + 18 test files in packages/store-qdrant
Evidence
  • Security workflow PASS at e23d4d5a
  • Ultra-security review PASS: brisk-indigo-badger
  • A11y WCAG AA PASS after build
  • Platform smoke PASS after build
  • TrustBench report-card framework shipped; several parameters tracked as not_evaluated
Evidence
  • Release SHA: e23d4d5a
  • Ultra-security review: brisk-indigo-badger PASS
  • Ledger generated: 2026-07-23

Read the release evidence.

The release evidence ledger explains how each gate was evaluated, what passed, what is partial, and what remains planned.

Read the docs
Trust & Security