v0.9.10 — TieredEngine, T-I-F RFC, IP Protection & Deploy Hardening

Highlights

This release spans 35 commits and 20 merged PRs since v0.6.0 (2026-05-21), covering three weeks of major infrastructure evolution: production TieredEngine activation with baked Model2Vec, the T-I-F (Truth-Indeterminacy-Falsity) decision provenance RFC validation (Phases 1 & 2), IP protection via ORCID-embedded licensing, and extensive deploy pipeline hardening.

---

Features

TieredEngine Production Activation

• DAKERA_TIERED=1 + DAKERA_SEARCH_MODE=hybrid in all deploy configs (#144) — wires the new TieredEngine and hybrid search mode (BM25 + vector ANN) into docker-compose.yml, docker-compose.ha.yml, docker-compose.local.yml, and k8s/configmap.yaml. Mirrors core engine PR#554 (DAK-6051).
• Production tier flip + baked Model2Vec image (#156) — activates DAKERA_TIERED=1 in production and pins the image to optA-baked-ec6ef91, which bakes the Model2Vec vocab_matrix.bin into the container image (eliminating runtime HuggingFace download and the 404 blocker from DAK-6182). Delivers 9.7× ingest throughput improvement.
• Tiered default rollback (#151) — temporary DAKERA_TIERED=0 default while Model2Vec matrix wasn't baked into the image (DAK-6203). Superseded by #156.

T-I-F Decision Provenance RFC (RFC #161)

Community contributor Jean-Sebastien Beaulieu (@SeCuReDmE-main-dev) proposed adding a neutrosophic T-I-F (Truth, Indeterminacy, Falsity) decision-provenance layer to Dakera's memory system, enabling agents to evaluate memory reliability before reuse.

• Phase 1: T-I-F reliability validation (#162) — validation package proving that metadata.reliability = { t, i, f } on memory entries changes agent-side reuse decisions in a useful way. Includes docker-compose overlay, example memories, and validation scripts.
• Phase 2: Feedback-derived provenance (#163) — extends Phase 1 with feedback-derived T-I-F evaluation, session-scoped metadata.decision_provenance trace memories, and explicit memory links from decision traces to evidence memories. Includes scenario recall proofs and associated recall validation.

Runner & Infrastructure Automation

• Runner health monitor (#135) — systemd timer fires every 5 minutes on both ARM and x64 runners, auto-restarts failed/OOM-killed actions.runner.* services, and sends Telegram alerts on any restart or OOM event. Includes image bump 0.11.55→0.11.59.
• OOM alert cooldown (#138) — adds 1-hour cooldown to OOM Telegram alerts, preventing notification spam when OOM kills recur (DAK-5864).
• Weekly namespace cleanup (#146) — automated scheduled workflow cleans up stale namespaces from bench preflight scripts, smoke tests, and verification agents (34 stale namespaces with 320+ vectors found, DAK-6099).
• Hetzner server resize action (DAK-6253) — cold-resize support for bench runners (poweroff → change_type → poweron) enabling cpx31→cpx41 upgrades without losing runner registration. Includes emergency poweron action for server recovery.

IP Protection & License Integrity

• ORCID-embedded LICENSE (#166) — SPDX-License-Identifier header + founder ORCID (0009-0007-2641-7727) embedded in LICENSE for unambiguous attribution.
• SECURITY.md — vulnerability reporting policy with ORCID reference, responsible disclosure process.
• License-integrity workflow — CI validates SPDX headers and LICENSE consistency on every push and PR.

---

Fixes

Deploy Pipeline

• Request timeout 120→600s (#132) — fixes HTTP 408 during LME bench batch ingest exceeding 120s under load (P0 DAK-5553).
• Container memory 4G→8G (#134) — production dakera container OOM during LME bench at 86% memory utilization (3.4GiB/4GiB).
• HF_TOKEN passthrough (#136) — adds HF_TOKEN + HUGGING_FACE_HUB_TOKEN env var passthrough to dakera service for GLiNER NER model downloads (DAK-5791).
• Health gate with moving tags (#152) — deploy-production.yml no longer marks edge/latest deploys as failures when the deploy fully succeeds.
• Build SHA health check (#153) — health check verifies build_sha from /health response (not semantic version) for hotfix/edge deploys (DAK-6265).
• Stale container cleanup (#160) — removes stale containers before docker compose up --force-recreate to prevent "container name already in use" failures. Also fixes hadolint CI on ARM (DAK-6541).

Build & Runner

• libbz2-dev for RocksDB (#157) — adds missing libbz2-dev package to runner provisioning for RocksDB compilation (DAK-6352).

---

Engine Image Tracking

This release tracks 8 Dakera engine releases via image bumps:

Image	Key Changes	PR
0.11.55→0.11.59	Runner health automation	#135
0.11.59→0.11.61	CE-95 (HNSW ef_search 50→100) + GLiNER HF model path fix	#137
0.11.61→0.11.66	Weekly batch	#139
0.11.66→0.11.75	Binary HNSW + TieredEngine wiring + CE-126 temporal anchor	#143
0.11.75→0.11.77	—	#145
0.11.77→0.11.80	CE-TORA8 temporal gate (Cat3 +5.9pp to 76.6%) + GPU OOM fixes	#147
0.11.80→0.11.81	OnnxBackend BFCArena fix + candle-core sync	#150
Pin: optA-baked-ec6ef91	Model2Vec baked matrix + TieredEngine production activation	#156

---

Dependencies

• Rust 1.95-bookworm → 1.96-bookworm in Docker (#148)
• actions/checkout 4 → 6 (#149)

---

Documentation

• Unified LoCoMo benchmark score to 88.2% in README (commit 1a4f7cf)

---

Collaborator Acknowledgment

Special thanks to Jean-Sebastien Beaulieu (@SeCuReDmE-main-dev) for:

• Proposing the T-I-F Decision Provenance RFC (#161) and contributing the Phase 1 and Phase 2 validation packages
• Recommending ORCID embedding within LICENSE files for IP protection

Author

Mohamed Amine Ferhi
ORCID: 0009-0007-2641-7727

Full Changelog: v0.6.0...v0.9.10

v0.6.0 — Audit Gap Fixes (DAK-5453)

What's Changed

Fixed

• K8s MCP deployment image: 0.9.2 → 0.10.8 (14 versions behind)
• K8s Dashboard version labels: 0.3.28 → 0.3.29 (label/image mismatch)
• Dockerfile: replace invalid COPY --if= syntax with ARG-gated Netskope cert pattern
• Dockerfile.dev: apply same ARG-gated cert pattern as production Dockerfile
• docker-compose.yml ODE sidecar image: 0.9.0 → 0.2.0 (only available tag on GHCR)
• k8s configmap: add DAKERA_REQUEST_TIMEOUT: "120" (present in docker-compose, missing in k8s)

Added

• .env.example: DAKERA_ENCRYPTION_KEY, DAKERA_REQUEST_TIMEOUT, DAKERA_GRPC_ENABLED
• Dockerfile: source-build notice at top
• README: "Client Tools" section — dk CLI and npx @dakera-ai/dakera-mcp quickstart

Full Changelog: https://github.com/Dakera-AI/dakera-deploy/blob/main/CHANGELOG.md

v0.2.5

Changes

Fixed

• Scope HA compose stack ports to HA_ prefix — prevents port binding conflicts when single-node and HA stacks run on same host (DAK-833)
• Add explicit name: dakera-ha / name: dakera to compose files — prevents Compose project name collision that caused MinIO eviction from the network when starting HA stack alongside single-node stack (DAK-829)

Changed

• Bump dakera-dashboard default image: 0.3.23 → 0.3.24 → 0.3.25

v0.2.4

What's Changed

• feat: Kubernetes support + Grafana modernisation (DAK-721) by @ferhimedamine in #34
• fix: bump k8s/helm to v0.8.2 + add kustomize CI validation (DAK-739) by @ferhimedamine in #35
• chore: bump dakera 0.8.1→0.8.2 + dashboard 0.3.22→0.3.23 (DAK-767) by @ferhimedamine in #36

Full Changelog: v0.2.3...v0.2.4

v0.2.3

v0.2.3 — Bump dakera image to v0.8.1

Fixed

• Bump dakera image: 0.8.0 → 0.8.1 across all compose and HA configs (DAK-679 optional vector in hybrid search, INFRA-2, DAK-664)

v0.2.2 — Dashboard 0.3.22

What's Changed

Fixed

• Bump dakera-dashboard: `0.3.6` → `0.3.7` → `0.3.8` → `0.3.10` → `0.3.12` (UTF-8 WASM panic fix — Memory Network graph render) → `0.3.13` (nginx WASM gzip fix) → `0.3.14` (regression fixes) → `0.3.16` (WASM size reduction via fat LTO + panic=abort) → `0.3.18` (WASM permanent load fix) → `0.3.20` (DX improvements) → `0.3.21` → `0.3.22` (DAK-571 health badge + key sync) (#22, #23, #25, #26, #27, #28, #29)

Full Changelog: https://github.com/Dakera-AI/dakera-deploy/blob/main/CHANGELOG.md

v0.2.1 — Image bumps: dakera 0.6.4, dashboard 0.3.6

What's Changed

• chore(deploy): bump dashboard image 0.3.3 → 0.3.4 by @ferhimedamine in #20
• chore(deploy): sync HA compose to dakera v0.6.4 by @ferhimedamine in #19
• chore: bump dashboard 0.3.4 → 0.3.5 (DAK-353 critical fixes) by @ferhimedamine in #21

Full Changelog: v0.2.0...v0.2.1

v0.2.0 — Devcontainer + Pinned Images + CI Hardening

What's Changed

Added

• VS Code / Cursor devcontainer for one-command local dev stack (#8)
• Pinned default images to versioned tags in all compose files — dakera 0.6.4, dakera-dashboard 0.3.3

Fixed

• Remove broken Docker publish workflow; add valid no-op release workflow (#6, #7)
• Remove v prefix from GHCR image tags — GHCR publishes 0.6.x not v0.6.x (#10)
• Bump dakera: 0.6.0 → 0.6.2 (Memory Network fix) → 0.6.3 (rustls patch) → 0.6.4 (SSE auth) (#12, #14, #17)
• Bump dakera-dashboard: 0.3.0 → 0.3.1 (Safari) → 0.3.2 (WASM + mobile) → 0.3.3 (SSE api_key)
• Sync HA compose image versions to match standard compose

Security

• Add explicit GITHUB_TOKEN permissions to CI workflow (#5)

Full Changelog: https://github.com/Dakera-AI/dakera-deploy/blob/main/CHANGELOG.md

v0.1.1 — Security Fix SA-2026-001

Security Fix — SA-2026-001 (Critical)

This patch release fixes three critical insecure-default vulnerabilities in the Docker Compose configuration. All users should upgrade immediately.

Vulnerabilities Fixed

1. Auth disabled by default — DAKERA_AUTH_ENABLED default changed from false to true. The variable is now required; startup fails if unset.

2. Public MinIO bucket — Anonymous download policy removed from the minio-setup init container. All stored vector data was previously readable without authentication.

3. Hardcoded dev API key fallback — DAKERA_ROOT_API_KEY no longer has a default value. Containers refuse to start until a real key is supplied in .env.

Additional Changes

• Resource limits added for dakera and minio services
• docker/.env.example restructured with required fields prominently at top
• README.md: Security section added with production hardening requirements

Upgrade Steps

1. Pull the latest docker-compose.yml
2. Copy .env.example to .env and fill in all required values
3. Restart your deployment

See the full advisory: SA-2026-001

---

🐳 Docker image: ghcr.io/dakera-ai/dakera:0.1.1