Prepare v2.8.0: harden agent memory and scoped answerability

[RodCor]

This prepares Kimetsu v2.8.0 with durable agent memory, opt-in scoped fact answerability, and release security hardening. A staging port fact can support the port portion of a port-and-timeout question while reporting timeout missing; production facts cannot silently fill a staging request.

Changes

• Make corrections durable, refresh ANN state across writers, bind feedback to delivered claim revisions, and preserve lifecycle and replay integrity through rebuilds and sync.
• Bound final MCP delivery, isolate warm-start and episode context, and align measured retrieval with production behavior.
• Add schema 15's rebuildable fact projection, exact unit normalization, partial/conflicting evidence metadata, and tagged agent-ingress support. The guard stays disabled by default; projection maintenance still adds storage/write work.
• Expose rerank cutoffs, a pinned optional multilingual model, and optional inference thread control without promoting new defaults.
• Update all seven workspace packages and inter-crate pins to 2.8.0, prepare the changelog and answerability documentation, and fix release-note extraction for titled version headings. The SDK retains its independent version; binary npm wrapper templates are stamped by the release workflow.
• Include reproducible audit artifacts and update the README and evaluation contract. Much of the large diff is preserved benchmark evidence from the accumulated work.

Security review

• Fresh RustSec, SDK npm, and Dependabot checks report zero known dependency vulnerabilities in the main repository. Replace yanked der 0.8.0 with 0.8.2; the existing h2 0.4.16 fix is included. Two informational transitive maintenance notices remain (paste, rustls-pemfile).
• Reject Windows repository aliases and redirected repository roots, and validate existing brain state paths before the initialization shortcut.
• Validate Bedrock regions, encode model IDs as one path segment, enforce HTTPS, and disable redirects for signed requests.
• Inspect all 47 existing CodeQL findings: 41 reported HTTP paths are blocked by the remote tool allowlist, with an exhaustive HTTP regression test; two logging findings concern a conversation ID and an environment variable name. Four findings prompted the transport/path hardening above. These are reviewed dispositions, not a claim that GitHub has closed all alerts. No alerts were dismissed and no scanning rules were disabled; the new scan and maintainer disposition of false positives remain outstanding.
• Refresh the companion benchmark lockfile for 2.8.0 and patch its older h2, quinn-proto, anyhow, and cxx advisories plus yanked der. Its fresh RustSec audit has zero vulnerabilities and only the informational paste notice.

See the release security review for alert IDs, evidence, and filesystem threat-model limits. This PR prepares the release; no tag, merge, publication, or release dispatch has been performed.

Latest measured comparison

Frozen synthetic fixture, 45 cases repeated twice:

Metric	Before	After
Positive retrieval hits	24/27	24/27
Unwanted injections	15/18	3/18
P95 MCP latency	376.6 ms	386.6 ms
Mean MCP result bytes	613.5	651.2

Exact answerability metadata matched 36/45 cases in each repeat. Across development, prior answerability, and this validation fixture, 688 observations covering 299 scenario/query cases had no positive-hit losses, errors, or unpaired observations. The latest injection reduction is 80%, with approximately 2.7% higher p95 latency and 6.2% more response bytes.

These are evidence-delivery measurements, not generated-answer accuracy or a replacement overall BrainBench score. Six compound-attribute cases and three unsupported-subject cases still fail exact metadata expectations per repeat. The fixture uses three authored template families. No extra model calls are introduced, but delivered context still consumes tokens.

See the complete report for configuration, source and binary fingerprints, all-repeat scoring, and limitations. The measured implementation is 3ae8329 with harness 2c74dad. Release-preparation changes have separate regression validation; the original benchmark artifacts and fingerprints are preserved.

Validation

• Fresh full Windows workspace tests with CLI embeddings,pi,openclaw and remote tls: 1,500 passed, six ignored, zero failures. User-brain access and the background embed daemon were disabled for the run.

• cargo fmt --all --check passed. Workspace/all-target Clippy with -D warnings passed with both the release feature set above and --no-default-features.

• All seven workspace versions and inter-crate pins checked at 2.8.0; freshly built CLI and remote binaries both report 2.8.0.

• The actual release workflow's awk extraction passed for the 2.8.0, 2.7.0, and 2.6.1 changelog sections.

• Fresh companion benchmark tests against the updated lockfile and Kimetsu 2.8.0 passed all 132 Rust tests. Previous runner validation passed 18 Python tests; optimized CLI/harness builds and six real CLI/MCP probes passed for the measured implementation.

• The companion website's full npm run check passed, including 29 tests and a production build; no deployment performed.

• GitHub CI and CodeQL must rerun on the updated PR head before release.

Companion PRs

• Benchmark harness (merged), with dependency security and 2.8.0 compatibility follow-up (private repository; parent path dependencies require this Kimetsu branch).
• Website documentation (unreleased labels until publication).