CortexDB 0.9.11

A data-loss fix, and the tests that should have caught the v0.9.9 authentication bypass before a reader reported it.

Before you upgrade

Nothing in this release changes a contract. If you are on v0.9.10, the upgrade notes there still apply and no new ones are added.

If you are still on v0.9.9 or earlier, read the v0.9.10 notes first: scope types are validated when a scope is created, and an explicitly configured embedding endpoint with no credential is now a boot refusal rather than a silent fallback to meaningless vectors.

Fixed

An embedding-provider outage no longer discards acknowledged writes.

This is the reason for the release. A transient failure of the embedding endpoint during indexing did not merely leave the write pending: the indexer durably excluded the event from recall within roughly half a second, and never reconsidered it after the provider recovered. The write had been acknowledged. It was gone, permanently, and POST /v1/admin/index-audit reported the store healthy because its check is a presence test that the excluded event does not appear in.

The recovery path now distinguishes four outcomes instead of a boolean, because the decision turns on whether the event reached the write-ahead log, and collapsing "never became durable" into "durable but its re-index failed" is the conflation the bug was made of. Vector repair under the strict policy now embeds before it writes anything, so an unavailable provider writes nothing rather than a partial row.

The trade this makes, stated plainly: a sustained provider outage now holds the indexer rather than dropping individual events, so lag grows and ?wait=indexed times out for the duration. Durability over liveness, which is the right way round for a write you have already acknowledged. It clears on its own when the provider returns.

GET /v1/experience/status no longer reports "indexing in progress" forever for an event the indexer has permanently given up on. It read only an in-memory map that does not carry that verdict and does not survive a restart; it now reads the stored record. An erased event carries the same marker and is still not reported as an indexing failure.

The keyless authentication posture is now honest in the boot log. The server logged that every request is served as a fixed local identity; in fact a keyless server serves each request as whatever actor the caller names, with that actor's capabilities, and the deployment preset does not restrict it. The log now says so, and the posture line reports whether unsigned actors are accepted.

To be explicit, since the v0.9.9 report that prompted this is public: the authentication bypass it describes was fixed in v0.9.10, not here. A request carrying only an actor header and no bearer has been refused since that release, both when you set an API key and when the server generates one for a network-exposed bind. What this release adds is the regression tests that pin it, including the generated-key path, and an end-to-end check of the exact configuration that was reported.

Documentation

The getting-started guide now documents all three authentication postures, including the generated key written to the data directory on a keyless network-exposed boot, which was previously described only in source comments.

Clients

cortexdb-mcp 0.7.5

Three tools could not succeed on any call in 0.7.4. memory_delete sent a selector together with a confirm-all flag, which the server refuses as ambiguous. advanced_search sent a temporal filter the server rejects as an unknown field, and silently ignored its own source and episode-type filters, which are now implemented rather than advertised and dropped. Cached authentication tokens were never refreshed, so once one expired every call returned 401 until the state file was deleted by hand.

The other clients are unchanged from v0.9.10: cortexdbai 0.11.2 on PyPI and 0.9.3 on npm, cortexdb-connectors 0.2.21, cortexdb-cli 0.5.4.

Notes

Single-node remains the only supported topology.

POST /v1/experience?wait=settled is still accepted but cannot succeed and returns 503 SETTLEMENT_UNAVAILABLE. Use wait=indexed.

One caution for anyone migrating embedding providers by hand: the index audit's repair rebuilds chunk vectors only. Entity and derived vectors are written by the enrichment and derived-layer builds, and the audit neither rebuilds them nor reports them missing, so a store whose vector directories were deleted and repaired will report clean while those two spaces are empty. A supported migration path is designed but not yet built.