chore: harden v0.1 release pipeline

Author: ECD5A

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -84,7 +84,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust 1.95
         uses: dtolnay/rust-toolchain@master

.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -29,10 +29,34 @@ jobs:
           cargo fmt --check
           cargo test --locked --workspace
           cargo clippy --locked --workspace --all-targets -- -D warnings
+          cargo fmt --manifest-path tools/agent-memory-eval/Cargo.toml -- --check
+          cargo test --manifest-path tools/agent-memory-eval/Cargo.toml
+          cargo clippy --manifest-path tools/agent-memory-eval/Cargo.toml --all-targets -- -D warnings
+          RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps
+
+  msrv:
+    name: Verify Rust 1.95 MSRV
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Install Rust 1.95
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.95.0
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          key: release-msrv-1.95
+
+      - name: Check workspace on MSRV
+        run: cargo check --locked --workspace --all-targets
 
   build:
     name: Build ${{ matrix.target }}
-    needs: verify
+    needs: [verify, msrv]
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -53,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -97,7 +121,7 @@ jobs:
           "$hash  ${{ matrix.archive }}" | Set-Content -Encoding ascii "dist/${{ matrix.archive }}.sha256"
 
       - name: Upload archive
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ matrix.target }}
           path: |
@@ -111,17 +135,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download archives
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: dist
           merge-multiple: true
 
+      - name: Prepare checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          cat dist/*.sha256 | sort > dist/SHA256SUMS
+          rm dist/*.sha256
+
       - name: Create or update draft release
         env:
           GH_TOKEN: ${{ github.token }}
+        shell: bash
         run: |
+          set -euo pipefail
+          assets=(dist/*.tar.gz dist/*.zip dist/SHA256SUMS)
           if gh release view "${GITHUB_REF_NAME}" >/dev/null 2>&1; then
-            gh release upload "${GITHUB_REF_NAME}" dist/* --clobber
+            gh release upload "${GITHUB_REF_NAME}" "${assets[@]}" --clobber
           else
-            gh release create "${GITHUB_REF_NAME}" dist/* --draft --generate-notes --title "${GITHUB_REF_NAME}"
+            gh release create "${GITHUB_REF_NAME}" "${assets[@]}" --draft --generate-notes --title "${GITHUB_REF_NAME}"
           fi

QUICKSTART.md

@@ -4,7 +4,7 @@ This guide shows the shortest path to a working local Memory Genome store.
 
 ## Use A Release Binary
 
-For the public preview release, download the archive for your platform from:
+Download the latest release archive for your platform from:
 
 ```text
 https://github.com/ECD5A/Memory-Genome-Engine/releases

SECURITY.md

@@ -4,7 +4,7 @@ Memory Genome Engine has a full security and threat-model document in [docs/SECU
 
 ## Supported Versions
 
-Security fixes target the current `main` branch and the latest GitHub release candidate when one exists.
+Security fixes target the current `main` branch and the latest supported GitHub release.
 
 ## Reporting A Vulnerability
 

docs/RELEASE.md

@@ -264,6 +264,7 @@ Use `--help` on either benchmark binary for deeper development-only options. Cor
 - `cargo fmt --check` passes.
 - `cargo test --locked` passes.
 - `cargo clippy --locked --workspace --all-targets -- -D warnings` passes.
+- `cargo audit` reports no known vulnerable runtime dependencies.
 - `RUSTDOCFLAGS="-D warnings" cargo doc --locked --workspace --no-deps` passes.
 - `cargo check --locked -p mge-cli --bins` passes.
 - `cargo build --locked -p mge-cli --bin mge --bin mge-mcp-server --release` passes.
@@ -294,7 +295,7 @@ Use `--help` on either benchmark binary for deeper development-only options. Cor
 
 ## Tag Release Workflow
 
-`.github/workflows/release.yml` runs only for `v*` tags. It first verifies format, workspace tests, and strict clippy with the locked dependency graph. It then builds checksummed product archives for Windows x86-64, Linux x86-64, macOS Apple Silicon, and macOS Intel, uploads them as workflow artifacts, and creates or updates a **draft** GitHub Release. The workflow includes only `mge` and `mge-mcp-server`; SDK packages and development benchmark binaries are not published. A maintainer must review checksums, notes, and every platform result before publishing the draft.
+`.github/workflows/release.yml` runs only for `v*` tags. It verifies format, workspace and eval tests, strict clippy, rustdoc, and Rust 1.95 compatibility with the locked dependency graph. It then builds checksummed product archives for Windows x86-64, Linux x86-64, macOS Apple Silicon, and macOS Intel, uploads them as workflow artifacts, and creates or updates a **draft** GitHub Release with one combined `SHA256SUMS`. The workflow includes only `mge` and `mge-mcp-server`; SDK packages and development benchmark binaries are not published. A maintainer must review checksums, notes, and every platform result before publishing the draft.
 
 Rust crates and both repository-local SDK manifests use version `0.1.0`. Integration schema versioning is independent from package versioning.
 
@@ -312,14 +313,16 @@ Do not publish packages from this repository until release ownership, versioning
 
 Current recommendation: GitHub release assets are enough for the public preview. Package-manager publishing should wait until Windows, Linux, and macOS preview users have exercised the archives.
 
-## GitHub Preview Release
+## GitHub v0.1 Release
 
-For a first public preview, create a draft release from a clean `main` commit after the checklist above passes.
+Create the first public `v0.1.0` release from a clean `main` commit after the checklist above passes. Use `v0.1.0-rc.1` first to exercise the complete private tag workflow and exact release archives.
 
 Recommended assets:
 
-- Windows archive from `scripts/build-release.ps1`;
-- Linux archive from `scripts/build-release.sh`;
+- `mge-windows-x86_64.zip`;
+- `mge-linux-x86_64.tar.gz`;
+- `mge-macos-aarch64.tar.gz`;
+- `mge-macos-x86_64.tar.gz`;
 - combined `SHA256SUMS`.
 
 Keep the release product-focused:
@@ -329,15 +332,11 @@ Keep the release product-focused:
 - do not upload generated stores, logs, passphrases, private corpus data, or `target/` directories;
 - state that macOS is a supported CI/release target but was not executed locally on this Windows development host.
 
-Draft release command shape:
+Tag command shape:
 
 ```bash
-gh release create v0.1.0-preview --draft \
-  --title "v0.1.0-preview" \
-  --notes-file release-notes.md \
-  target/mge-release/archives/mge-windows-x64.zip \
-  target/mge-release/archives/mge-linux-x86_64.tar.gz \
-  target/mge-release/archives/SHA256SUMS
+git tag -a v0.1.0 -m "Memory Genome Engine v0.1.0"
+git push origin v0.1.0
 ```
 
-Do not publish the draft until the uploaded assets and checksums are reviewed.
+The tag workflow creates the draft and uploads all platform archives. Do not publish it until the downloaded assets, checksums, release notes, and platform jobs are reviewed.

scripts/build-release.ps1

@@ -58,7 +58,11 @@ $Os = if ([System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform([Sys
 } else {
     "linux"
 }
-$Arch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()
+$Arch = switch ([System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture.ToString().ToLowerInvariant()) {
+    "x64" { "x86_64" }
+    "arm64" { "aarch64" }
+    default { $_ }
+}
 $LayoutDir = Join-Path $TargetRoot (Join-Path "mge-release" "$Os-$Arch")
 $LayoutBinDir = Join-Path $LayoutDir "bin"
 $LayoutDocsDir = Join-Path $LayoutDir "docs"

scripts/build-release.sh

@@ -52,7 +52,24 @@ for name in "${product_bins[@]}"; do
   find_bin "$name" >/dev/null
 done
 
-platform="$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | tr '[:upper:]' '[:lower:]')"
+case "$(uname -s)" in
+  Linux*) os="linux" ;;
+  Darwin*) os="macos" ;;
+  MINGW*|MSYS*|CYGWIN*) os="windows" ;;
+  *)
+    echo "unsupported release platform: $(uname -s)" >&2
+    exit 1
+    ;;
+esac
+case "$(uname -m)" in
+  x86_64|amd64) arch="x86_64" ;;
+  arm64|aarch64) arch="aarch64" ;;
+  *)
+    echo "unsupported release architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+platform="$os-$arch"
 layout_dir="$target_root/mge-release/$platform"
 layout_bin_dir="$layout_dir/bin"
 layout_docs_dir="$layout_dir/docs"