v0.15.3 release prep: first release from AliceMemory

.ai/handoff/CURRENT_STATE.md

@@ -153,3 +153,7 @@ carried a release-gate step that could not run on a CI runner, so the gate
 could never pass from that tag, and repository rules correctly refuse both
 deletion and update of stable tags. No GitHub Release or PyPI artifact was
 ever created for it.
+
+## What `v0.15.3` Targets
+
+`v0.15.3` is the current release candidate. It is not published.

ARCHITECTURE.md

@@ -249,3 +249,5 @@ usage justifies a separately reviewed boundary.
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+## v0.15.3 — 2026-08-15
+
+- First release published from `samrusani/AliceMemory`. Project URLs corrected;
+  documents under `docs/release/` and `docs/archive/` intentionally keep the
+  former name, since they describe artifacts signed from it.
+- setuptools 83 to 84 for the build backend. Wheel records
+  `Generator: setuptools (84.0.0)`, metadata version unchanged at 2.4.
+- twine constraint widened to `<8.0` and exercised against the release artifacts.
+- All three CodeQL action pins moved to v4.37.4 together; they cannot move
+  separately without CodeQL refusing to run.
+- pnpm setup action pin converted from a tag-object SHA to the equivalent
+  commit SHA.
+- `@testing-library/react` 16.3.2.
+- Corrected four references to systemd units that are not shipped.
+
+No functional change to the library. No migration, no schema change.
+
 - The repository was renamed from `samrusani/AliceBot` to
   `samrusani/AliceMemory` on 2026-08-14, matching the `alice-memory` package
   name and the alicememory.com domain. Documents under `docs/release/` and

CURRENT_STATE.md

@@ -153,3 +153,7 @@ carried a release-gate step that could not run on a CI runner, so the gate
 could never pass from that tag, and repository rules correctly refuse both
 deletion and update of stable tags. No GitHub Release or PyPI artifact was
 ever created for it.
+
+## What `v0.15.3` Targets
+
+`v0.15.3` is the current release candidate. It is not published.

PRODUCT_BRIEF.md

@@ -65,3 +65,5 @@ Agent developers — people building or operating AI agents who need durable, ex
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

README.md

@@ -203,3 +203,5 @@ MIT — see [LICENSE](https://github.com/samrusani/AliceMemory/blob/main/LICENSE
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

RELEASING.md

@@ -407,3 +407,5 @@ macOS with `shasum -a 256 -c SHA256SUMS`.
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

ROADMAP.md

@@ -87,3 +87,5 @@ restore, recorded security disposition) shipped in Phases 4 and 5.
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

apps/web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@alicebot/web",
   "private": true,
-  "version": "0.15.2",
+  "version": "0.15.3",
   "packageManager": "pnpm@10.23.0",
   "scripts": {
     "dev": "next dev",

docs/release/v0.15.3-release-notes.md

@@ -0,0 +1,86 @@
+# Alice v0.15.3 Release Notes
+<!-- alice-release-state: {"schema_version":"alice_release_document_state_v1","version":"0.15.3","publication_status":"pending","checksums_status":"pending"} -->
+
+**A maintenance release. The repository moved to `samrusani/AliceMemory`, and
+this is the first version published from it.**
+
+There are **no functional changes** to the library. If you are running
+`v0.15.2`, nothing in your deployment behaves differently after upgrading, and
+there is no reason to hurry.
+
+If you are running `v0.14.0` or earlier, take `v0.15.2` or later promptly: those
+releases added agent-key authentication to `/v1`, which had none before.
+
+## The repository is now `samrusani/AliceMemory`
+
+The project name, the PyPI package `alice-memory`, and the domain
+alicememory.com all agreed with each other. The repository did not. It does now.
+
+Every link in this release points at the new location. GitHub redirects the old
+name, so existing clones, bookmarks and scripts keep working, but a redirect
+lasts only until someone creates a repository at the freed name, so the
+published metadata is corrected here rather than left to depend on it.
+
+Documents under `docs/release/` and `docs/archive/` deliberately keep the former
+name. They describe artifacts that were built and signed from it, and PyPI's
+attestations bind those bytes to the old repository permanently. Rewriting them
+would put a document in conflict with the signed record of the artifact it
+describes.
+
+## Build and CI maintenance
+
+- setuptools moves 83 to 84. The build output was checked rather than assumed:
+  the wheel records `Generator: setuptools (84.0.0)` and the metadata version is
+  unchanged at 2.4.
+- The twine constraint widens to `<8.0`. twine 7.0.0 was published on
+  2026-07-27, so this admits it immediately rather than pre-authorising
+  something hypothetical, and it was exercised against these artifacts before
+  the change landed.
+- All three CodeQL action pins move to v4.37.4 together. They cannot move
+  separately: CodeQL refuses to run when its steps disagree on version.
+- The pnpm setup action pin converts from a tag-object SHA to the equivalent
+  commit SHA. Same code, more conventional and auditable form.
+- `@testing-library/react` moves to 16.3.2, a development dependency.
+
+## Documentation corrections
+
+Four references to systemd units that were never shipped are corrected. The
+packaged units are `alice-api.service`, `alice-scheduler.service` and
+`alice-web.service`; two guides named `alicebot-*` variants that do not exist
+and would have sent a self-hoster looking for units that were never installed.
+
+## Compatibility
+
+No database migration. No schema change. No API change. No behaviour change.
+
+The published artifacts are built by a newer setuptools, so their bytes differ
+from `v0.15.2` even where the source is identical. That is expected. Verify
+against the digests below rather than against any previous release.
+
+## Known limitations
+
+Unchanged from `v0.15.2`, and worth repeating because none of them are closed:
+
+- **`/v1` authenticates but does not authorize.** Every `/v1` request must
+  present a valid key, and it does not matter which one. A key minted as
+  `read_only_agent` can bootstrap a workspace, register providers, and supersede
+  memory over `/v1` exactly as an administrative key can. Profiles are enforced
+  on `/v0/vnext`, on the MCP tool surface, and in the CLI. **Keep `/v1`
+  loopback-only.**
+- **`/v1` writes are not attributed**, so a quarantine sweep by agent key cannot
+  reach them.
+- **The zero-setup `uvx` path does not produce retrievable memory.** Everything
+  written through `alice-memory mcp` lands as a review candidate, recall returns
+  nothing, and there is no approval route on that surface. Use the PostgreSQL
+  path until this is fixed.
+- **Importers trust the directory you point them at.** A local actor with write
+  access inside a selected import root can reach content outside it, by hard link
+  or by swapping an ancestor directory between listing and read.
+- **Archived import evidence is decoded text, not a byte image.** CRLF sources
+  archive as LF.
+
+## Install
+
+```bash
+pip install alice-memory==0.15.3
+```

docs/vnext/README.md

@@ -84,3 +84,5 @@ promotion of generated artifacts into trusted memory.
 
 `v0.15.2` is the latest published release and remains the install, checksum,
 and baseline reference.
+
+`v0.15.3` is the current release candidate. It is not published.

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "alice-memory"
-version = "0.15.2"
+version = "0.15.3"
 description = "Alice: the continuity layer for AI agents. Local-first memory with provenance, open loops, resumption, and review-governed writes."
 readme = "docs/pypi-description.md"
 license = "MIT"