Merge upstream/develop into feat/gossip-mvp

Author: jjcav84

.antigravity-plugin/skills/mempalace-recall/SKILL.md

@@ -65,8 +65,11 @@ and violates MemPalace's "memory should feel instant" budget.
 5. **After a substantive session**, record continuity with
    `mempalace_diary_write` (background hooks may already do this — do not
    double-file).
-6. **When a fact changes**, call `mempalace_kg_invalidate` on the old
-   fact, then `mempalace_kg_add` for the new one.
+6. **When a fact changes**, choose the operation that preserves temporal
+   history: use `mempalace_kg_supersede` for single-valued replacements
+   (model, employer, owner, address, current status),
+   `mempalace_kg_invalidate` for facts that ended without replacement,
+   and `mempalace_kg_add` for independent/coexisting facts.
 
 The full canonical protocol — shared verbatim with the Antigravity
 recall rule and the other integrations — lives in
@@ -78,6 +81,7 @@ recall rule and the other integrations — lives in
 |---|---|
 | Find any memory by meaning | `mempalace_search` (start here) |
 | Relational / time-bound facts about an entity | `mempalace_kg_query` |
+| Replace a single-valued fact | `mempalace_kg_supersede` |
 | The chronological story of an entity | `mempalace_kg_timeline` |
 | Recent session continuity | `mempalace_diary_read` |
 | Which wings / rooms exist (scope unknown) | `mempalace_list_wings`, `mempalace_list_rooms` |
@@ -97,8 +101,9 @@ question — not a system prompt or pasted conversation) plus optional
   installer `hooks/antigravity/install.sh`). Do not silently fall back
   to guessing from model memory.
 - **Stale or conflicting facts.** Prefer the knowledge graph's
-  time-valid answer; if a fact has changed, invalidate the old one and
-  add the new one rather than overwriting context silently.
+  time-valid answer. Use `mempalace_kg_supersede` for single-valued replacements,
+  `mempalace_kg_invalidate` for facts that ended without replacement,
+  and `mempalace_kg_add` for independent/coexisting facts.
 
 ## Anti-patterns — never do these
 

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "mempalace",
       "source": "./.claude-plugin",
       "description": "AI memory system — mine projects and conversations into a searchable palace. 36 MCP tools, auto-save hooks, guided setup.",
-      "version": "3.7.1",
+      "version": "3.8.0",
       "author": {
         "name": "milla-jovovich"
       }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mempalace",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "description": "Give your AI a memory — mine projects and conversations into a searchable palace. 36 MCP tools, auto-save hooks, and guided setup.",
   "author": {
     "name": "milla-jovovich"

.claude-plugin/skills/mempalace-recall/SKILL.md

@@ -44,8 +44,10 @@ a variable, fixing a typo). Recall is question-driven, not reflexive.
    stored content.
 4. After a substantive session, record continuity with
    `mempalace_diary_write` (skip if a background hook already saved).
-5. When a fact changes: `mempalace_kg_invalidate` the old fact, then
-   `mempalace_kg_add` the new one.
+5. When a fact changes: use `mempalace_kg_supersede` for
+   single-valued replacements, `mempalace_kg_invalidate` for facts that
+   ended without replacement, and `mempalace_kg_add` for
+   independent/coexisting facts.
 
 ## Unhappy paths
 
@@ -61,7 +63,9 @@ a variable, fixing a typo). Recall is question-driven, not reflexive.
   --archive-existing --yes`), not re-mine, which drops MCP-added drawers
   and diary entries (#1843). Do not repair in-process.
 - **Conflicting facts** — trust the knowledge graph's time-valid answer;
-  invalidate-then-add rather than overwriting silently.
+  use `mempalace_kg_supersede` for single-valued replacements,
+  `mempalace_kg_invalidate` for facts that ended without replacement,
+  and `mempalace_kg_add` for independent/coexisting facts.
 
 The canonical protocol, shared across all MemPalace integrations, lives
 in `integrations/shared/recall-protocol.md`.

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "mempalace",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "description": "Give your AI a memory — mine projects and conversations into a searchable palace. 36 MCP tools, auto-save hooks, and guided setup.",
   "author": {
     "name": "milla-jovovich"

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
         python-version: ["3.9", "3.11", "3.13"]
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
@@ -25,7 +25,7 @@ jobs:
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
           cache: 'pip'
@@ -47,7 +47,7 @@ jobs:
     runs-on: macos-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
           cache: 'pip'
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: 'pip'

.github/workflows/docker-publish.yml

@@ -77,7 +77,7 @@ jobs:
       # do not push.
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -106,6 +106,8 @@ jobs:
           # slow the PR check.
           platforms: ${{ github.event_name != 'pull_request' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
           push: ${{ github.event_name != 'pull_request' }}
+          provenance: mode=max
+          sbom: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha

.github/workflows/publish.yml

@@ -111,7 +111,7 @@ jobs:
           fi
           echo "Tag $TAG matches manifest version $py_version — OK."
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.13"
 

.github/workflows/version-guard.yml

@@ -10,6 +10,7 @@ on:
       - '.claude-plugin/marketplace.json'
       - '.claude-plugin/plugin.json'
       - '.codex-plugin/plugin.json'
+      - 'integrations/openclaw/SKILL.md'
       - '.github/workflows/version-guard.yml'
 
 jobs:
@@ -27,12 +28,16 @@ jobs:
           marketplace_version=$(jq -r '.plugins[0].version' .claude-plugin/marketplace.json)
           plugin_version=$(jq -r '.version' .claude-plugin/plugin.json)
           codex_version=$(jq -r '.version' .codex-plugin/plugin.json)
+          openclaw_version=$(grep -E '^version:' integrations/openclaw/SKILL.md | cut -d' ' -f2)
 
-          echo "py_version=$py_version" >> "$GITHUB_OUTPUT"
-          echo "pyproject_version=$pyproject_version" >> "$GITHUB_OUTPUT"
-          echo "marketplace_version=$marketplace_version" >> "$GITHUB_OUTPUT"
-          echo "plugin_version=$plugin_version" >> "$GITHUB_OUTPUT"
-          echo "codex_version=$codex_version" >> "$GITHUB_OUTPUT"
+          {
+            echo "py_version=$py_version"
+            echo "pyproject_version=$pyproject_version"
+            echo "marketplace_version=$marketplace_version"
+            echo "plugin_version=$plugin_version"
+            echo "codex_version=$codex_version"
+            echo "openclaw_version=$openclaw_version"
+          } >> "$GITHUB_OUTPUT"
 
           {
             echo "## Detected versions"
@@ -44,6 +49,7 @@ jobs:
             echo "| .claude-plugin/marketplace.json | \`$marketplace_version\` |"
             echo "| .claude-plugin/plugin.json | \`$plugin_version\` |"
             echo "| .codex-plugin/plugin.json | \`$codex_version\` |"
+            echo "| integrations/openclaw/SKILL.md | \`$openclaw_version\` |"
           } >> "$GITHUB_STEP_SUMMARY"
 
       - name: Verify all sources agree
@@ -53,6 +59,7 @@ jobs:
           MARKETPLACE: ${{ steps.versions.outputs.marketplace_version }}
           PLUGIN: ${{ steps.versions.outputs.plugin_version }}
           CODEX: ${{ steps.versions.outputs.codex_version }}
+          OPENCLAW: ${{ steps.versions.outputs.openclaw_version }}
         run: |
           set -euo pipefail
           fail=0
@@ -63,11 +70,12 @@ jobs:
               fail=1
             fi
           }
-          # All five must agree with each other (use version.py as the reference, per CLAUDE.md)
+          # All six must agree with each other (use version.py as the reference, per CLAUDE.md)
           check "pyproject.toml" "$PYPROJECT" "$PY"
           check ".claude-plugin/marketplace.json" "$MARKETPLACE" "$PY"
           check ".claude-plugin/plugin.json" "$PLUGIN" "$PY"
           check ".codex-plugin/plugin.json" "$CODEX" "$PY"
+          check "integrations/openclaw/SKILL.md" "$OPENCLAW" "$PY"
           exit $fail
 
       - name: Verify tag matches manifest (tag pushes only)
@@ -94,7 +102,7 @@ jobs:
 
           if [[ "$tag_version" != "$PY" ]]; then
             echo "::error::tag $GITHUB_REF_NAME does not match manifest version $PY"
-            echo "Bump mempalace/version.py, pyproject.toml, and all plugin manifests before tagging a stable release."
+            echo "Bump mempalace/version.py, pyproject.toml, all plugin manifests, and the OpenClaw skill before tagging a stable release."
             echo "For an internal/staging tag, use a semver pre-release suffix (e.g. v${PY}-rc1)."
             exit 1
           fi