MemForge: Portable, agent-neutral persistent memory format for AI coding agents (v0.5.6)

MemForge v0.5.6: portable, agent-neutral persistent memory format for coding agents. This deposit anchors the v0.5.6 ship state. v0.5.6 is the current head of the v0.5.x line; the spec snapshot (spec/VERSION) remains at 0.5.3 since v0.5.4 / v0.5.5 / v0.5.6 are reference-CLI patches with no normative spec change. The bundle ships the spec snapshot + the full reference-CLI artifacts (CHANGELOG, README, license, examples/). The v0.5.0 -> v0.5.6 sequence - v0.5.0 (2026-05-10): multi-identity team-scale memory + cryptographic attribution + WebSocket messaging substrate normative contract. Four-voice internal cross-family review panel pre-tag (architect + critic + commercial + threat-modeler).- v0.5.1: reference CLI under the unified memforge dispatcher (14 subcommands). Architect-only first-pass shipped; retrospective panel (critic + threat-modeler) was run after tag and surfaced two issues that drove v0.5.2.- v0.5.2: Unicode NFC normalization on signed envelopes (closes repudiation vector). File-create TOCTOU window in identity.py closed via O_CREAT|O_EXCL + atomic os.replace. Bounded seen-nonce set (MAY -> SHOULD). Native Windows support via NTFS ACL-based file restriction.- v0.5.3: closes 3 remaining v0.5.x MAJORs (registry-layer cool-down enforcement, bounded revocation walk with subprocess cleanup, TOCTOU-safe read via O_NOFOLLOW + post-open fstat). Pre-tag release-rigor panel (architect + critic + threat-modeler) ran on both spec delta and new code surface; panel surfaced 4 additional BLOCKER-class and 2 MAJOR-class findings (framing-injection in walk_revocation_set, locale-bound Windows ACL denylist, Windows TOCTOU overpromise, file-list incompleteness in invariant 21, bounded-walk escape-hatch undefined, subprocess cleanup not mandated). All closed in the same commit that ships v0.5.3.- v0.5.4: reference-CLI bug fix on memory-audit. False-positive "Orphan pointer (no file)" integrity violations for MEMORY.md pointers targeting subfolder detail files. Fix downgrades to a HEALTH advisory when the file exists at the subfolder path; truly-missing pointers remain INTEGRITY violations. No spec change.- v0.5.5: docs-only patch. New "Pick your transport: git-only or WebSocket?" decision-framing section in docs/team-bootstrap.md. New "Commit hygiene + signed memforge: prefixes" section in docs/quickstart.md. No spec or code change.- v0.5.6: docs + examples patch. Adds the examples/ directory with drop-in scripts. Bash + PowerShell parity for the commit-msg hook (enforces memforge: prefix grammar for Tier 2 scoped paths) and auto-commit watcher (auto-commits memory .md writes; skips Tier 2 scoped paths). WebSocket scaffold in examples/websocket/ (config.example.yaml + Python relay-probe diagnostic + README naming this as scaffold, NOT a deployable relay). No spec or code change in src/. Important: release-rigor framing Every release in the v0.5.x line ran an internal multi-voice review panel pre-tag (architect + critic + threat-modeler, sized to the patch scope). Findings surfaced by the panel were addressed before tag. This is an internal review pass; it is NOT a substitute for independent red-teaming, third-party pentest, or formal security audit. No external security audit has been performed on this release. Residuals tracked in known-limitations.md reflect the internal panel's review scope. Reference implementation (PyPI package ildan-memforge==0.5.6) - 14 CLI subcommands under a single memforge dispatcher (shipped v0.5.1, unchanged surface through v0.5.6; underlying _security + revocation + registry layers tightened across v0.5.2 / v0.5.3).- Cross-platform secure-file abstraction at memforge._security (POSIX mode bits + Windows ACLs via icacls + SDDL parsing, SID-based).- 233 tests pass on CI matrix ubuntu + macos + windows x Python 3.10 / 3.11 / 3.12 (2 GPG-gated tests skipped without secret material). Bundle contents - SPEC.md (spec_version 0.5.3; unchanged through the v0.5.x patches)- VERSION (spec version file; 0.5.3)- taxonomy.yaml- v0.5.6-known-limitations.md (living-doc snapshot at v0.5.6)- CHANGELOG.md (full history v0.3.0 through v0.5.6)- LICENSE (Apache-2.0)- README.md- examples/ — drop-in scripts (commit-msg hook bash + PowerShell, auto-commit watcher bash + PowerShell, WebSocket scaffold: config example + Python relay-probe + README) Defensive-publication context This is one of three timestamped third-party anchors for the MemForge spec text (Channel 1: Software Heritage SWHID; Channel 2: this Zenodo deposit; Channel 3: GitHub release tags). v0.5.1 / v0.5.2 were skipped in the Zenodo channel by maintainer decision; v0.5.3 was the first end-to-end-baked release deposited (DOI 10.5281/zenodo.20114965). v0.5.4 / v0.5.5 were intended to remain Channel-3-only per the patch-no-Zenodo cadence rule; v0.5.6 mints a fresh Zenodo version because the examples/ directory is canonical operator-side surface worth anchoring alongside the spec. v0.5.0 deposit at DOI 10.5281/zenodo.20113964 is the historical v0.5.0 spec snapshot anchor. Install pip install ildan-memforge Source code + spec history https://github.com/ildan-ai/memforge https://github.com/ildan-ai/memforge/releases/tag/v0.5.6 License: Apache-2.0