[Release] Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2

Current decision (2026-09-10)

Option (b) confirmed: release @bytefolk/mem-mcp@0.1.2. The 2026-09-03 keep-old-scope exception is superseded. #162 is registry-only; actual scope/cache migration and #168 version alignment must be integrated and reviewed before release. See #153 (comment). Existing acceptance and registry-write gates below remain in force.

Parent: bytefolk/.github#22
Related: #122

Outcome

Publish mem-mcp under the ByteFolk npm scope with a working OIDC release path, while keeping the old 0.1.1 package installable until migration is proven.

Exact plan

Rename @fullstack-ai-infra/mem-mcp@0.1.1 to @bytefolk/mem-mcp@0.1.2.
Migrate active npm, MCP, cache, documentation, installer, platform, test, and release identities to ByteFolk.
Preserve a safe compatibility path for an existing old cache; a migration must not delete user data.
Build and attach version-aligned v0.1.2 release binaries before claiming the npm wrapper is installable.
Replace the superseded Trusted Publishing candidate with a workflow using GitHub-hosted Node 24, npm >=11.15.0, id-token: write, environment npm-release, exact tag/main/package/assets gates, and registry readback.
After npm org control is verified, bootstrap 0.1.2-rc.0 to next with interactive 2FA, bind Trusted Publishing, publish 0.1.2 via OIDC to next, verify, then promote latest.
Deprecate @fullstack-ai-infra/mem-mcp only after clean installs and directory/consumer coordinates have migrated. Never unpublish it.

Acceptance

Source, package, release assets, MCP metadata, installer, cache compatibility, tests, and docs agree on ByteFolk/v0.1.2.
Clean Linux/macOS/Windows installation and launch checks pass.
npm readback verifies access, metadata, provenance, Trusted Publisher, and latest.
release: publish mem-mcp v0.1.1 and bootstrap npm Trusted Publishing #122 records the accepted replacement route and old-scope disposition.

fix(npm): follow the registry identifier to the bytefolk namespace

Proposal: a minimal rewrite of this body, because it now contradicts the decision it is tagged `status:ready` under

Author first: I am @waterbro-8. I did not write this plan and I am not its approver — it is
assigned to @PeterGuy326, who approved the .github#22 decision it implements. So this is a
proposal for you to accept, edit or reject, not an edit I made. I have not touched this issue's
body, labels, state or assignee. Everything below is a live readout from 2026-09-06 plus one
paste-ready patch.

Why this is not housekeeping

Today, in a review comment on a release-preparation PR in this repository
(#168#issuecomment-5557455654, 2026-09-06 06:27Z), a maintainer-facing argument was made that

Issue #153's title says "Migrate to @bytefolk/mem-mcp", but the actual decision documented
in the issue body aligns with #162 — npm scope stays, MCP registry migrates.

This body does not say that. It says the opposite, in its Exact plan:

Rename @fullstack-ai-infra/mem-mcp@0.1.1 to @bytefolk/mem-mcp@0.1.2.

Migrate active npm, MCP, cache, documentation, installer, platform, test, and release
identities to ByteFolk.

and in its first Acceptance item:

Source, package, release assets, MCP metadata, installer, cache compatibility, tests, and
docs agree on ByteFolk/v0.1.2.

and it ends with Deprecate @fullstack-ai-infra/mem-mcp only after …. The metadata rules out the
benign reading: this issue has 0 comments and updated_at == created_at == 2026-09-01T17:21:08Z,
so no amendment was ever recorded here. Any position that "the body" endorses keeping the npm scope
is being imported from somewhere else and attributed to this text.

The position itself is real, and I hold it. Its actual carriers are these two, not this body:

#154#issuecomment-5520408466 (2026-09-03 04:35Z, closing the rename PR):
"not wanted — the package rename to @bytefolk/mem-mcp. The decision keeps the published
scope…";
#122#issuecomment-5520663686 (2026-09-03 04:55Z): "the 2026-09-03 instruction to release v0.1.2
with the .github#22 HOLD cleared first and the npm package name staying
@fullstack-ai-infra" — a founder instruction that I recorded over there and never wrote
back here.

So the root cause is a stale approved contract, and I named it myself on 2026-09-03 in the #154
close comment:

Since #153 still reads "Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2", it now contradicts the
decision it is tagged status:ready under. It should be rewritten before someone implements it
again.

Three days later someone did, and the mis-citation went onto a PR that is waiting on a merge
decision. The rewrite I prescribed did not happen, and that omission is mine.

One fact worth keeping in view while deciding: the implementation of this plan as written
already exists. It was #154 (head bcd786f9528, 23 files on the live readout — my own
close comment below understated that as 15, so treat the API count as authoritative): the
npm/package.json name, npm/install.js PACKAGE and cache paths, npm/platforms.js,
npm/server.json, npm/install.test.js + clean-tarball.test.js, scripts/validate_release_version.sh,
server/cmd/mem-mcp/main.go, the three Helm values*.yaml + Chart.yaml, web/package.json +
lockfile, the four worker/ surfaces, README.md, npm/README.md, docs/DEPLOYMENT.md,
docs/maintainers/releasing.md, .github/workflows/release.yml and CHANGELOG.md. It was closed
unmerged on the founder instruction, not because the work was wrong. If the instruction is reversed,
that is the starting point; the commits are still reachable
(git fetch … refs/pull/154/head:pr-154).

Paste-ready replacement for the top of the body

Deliberately minimal: it prepends a status block and marks exactly the two affected plan items.
Nothing else in the body is reworded, so git-style review of this issue is a one-block read and
reversing the decision later is a one-block edit. Replace the current ## Outcome … ## Exact plan
region with:

## Decision status (recorded 2026-09-06; approver to confirm)

This plan was written on 2026-09-01 under the `.github#22` decision to migrate every active
`@fullstack-ai-infra/*` identity to `@bytefolk/*`. A later founder instruction, recorded on
2026-09-03 in #122 (comment 5520663686), says v0.1.2 ships with the npm package name **staying**
`@fullstack-ai-infra/mem-mcp`. That instruction was never written back into this body, which is
why this issue could be cited on 2026-09-06 for a position it does not state.

Resolution: the two identities are separate, and only one of them moves now.

- The **MCP registry identifier's namespace** is derived from the repository owner, is wrong on
  `main` today, and blocks the registry listing. It moves to `io.github.bytefolk/mem-mcp` in #162.
- The **npm package scope** is an unrelated string. Item 1 and item 2 below are SUPERSEDED
  pending the approver's confirmation of the 2026-09-03 instruction; if the instruction is
  reversed, #154 (`bcd786f9528`) is the implementation to re-land.

## Outcome

Publish mem-mcp with a working OIDC release path. The registry identity moves to the ByteFolk
namespace now; the npm package scope moves only if the founder instruction is reversed, while the
old 0.1.1 package stays installable until any migration is proven.

## Exact plan

1. SUPERSEDED 2026-09-03, approver to confirm — ~~Rename
   `@fullstack-ai-infra/mem-mcp@0.1.1` to `@bytefolk/mem-mcp@0.1.2`~~. Route if reversed:
   re-land #154.
2. SUPERSEDED in part — ~~Migrate active npm, MCP, cache, documentation, installer, platform,
   test, and release identities to ByteFolk~~. The MCP **registry** half is in scope and is
   carried by #162; the npm scope, installer cache path and package-identity half follows
   item 1.
3. Preserve a safe compatibility path for an existing old cache; a migration must not delete
   user data.
4. Build and attach version-aligned v0.1.2 release binaries before claiming the npm wrapper is
   installable.
5. Replace the superseded Trusted Publishing candidate with a workflow using GitHub-hosted
   Node 24, npm >=11.15.0, `id-token: write`, environment `npm-release`, exact
   tag/main/package/assets gates, and registry readback.
6. After npm org control is verified, bootstrap `0.1.2-rc.0` to `next` with interactive 2FA,
   bind Trusted Publishing, publish 0.1.2 via OIDC to `next`, verify, then promote `latest`.
7. Deprecate `@fullstack-ai-infra/mem-mcp` only after clean installs and directory/consumer
   coordinates have migrated. Never unpublish it.

## Acceptance

- [ ] The registry identifier, MCP metadata and #162 agree on `io.github.bytefolk/mem-mcp`.
- [ ] Either the 2026-09-03 instruction is confirmed here in writing, or every identity named in
      items 1-2 agrees on ByteFolk/v0.1.2. A mixed state where this issue and the shipped package
      disagree is not acceptance.
- [ ] Clean Linux/macOS/Windows installation and launch checks pass.
- [ ] npm readback verifies access, metadata, provenance, Trusted Publisher, and `latest`.
- [ ] #122 records the accepted replacement route and old-scope disposition.

Note the second acceptance item is the one doing the work. It is written so that the failure mode
that just happened — a published release whose scope disagrees with an open status:ready p0 —
cannot be scored as done.

What I did not do here

Did not edit this body, this label set (status:ready, priority:p0), the assignee or the state.
Did not close or reopen anything, did not vote or request a review, did not touch #154 or its
branch, did not create a tag, publish anything, or change the npm scope anywhere. Did not decide
which of the two readings wins: that is the founder instruction, so I routed it to its approver.
I did post a factual correction where the mis-citation occurred (#168), because there it was being
used to ask someone to merge.

Release decision — 2026-09-10

Confirmed: execute option (b), @bytefolk/mem-mcp@0.1.2, as specified in #153 and bytefolk/.github#22. This supersedes the 2026-09-03 instruction to retain the old npm scope for this version. Keep the old 0.1.1 package available; do not unpublish it.

Correction: #162 changes the MCP Registry identifier only; it does not rename the npm package. The implementation must integrate the actual package/cache migration from #154 and version alignment from #168 onto current main, retaining contributor attribution. Neither PR alone satisfies this decision.

The naming decision is now settled; release gates are not waived. Current-head CI and independent review are still required. The npm authentication check on 2026-09-10 returned ENEEDAUTH, so ownership/2FA/Trusted Publisher verification, binary releases, three-platform clean-install proof, registry publication and latest promotion remain outstanding. No registry writes or release claims are authorized by a green source test alone.

Current-main implementation candidate: #193, head bc0f73345774187f17c8e797bc2b3d4430f6d4a2. It integrates the actual ByteFolk package/cache migration, MCP identity and 0.1.2 version surfaces, with human attribution to #154/#162/#168.

Independent source preflight passed after reproducing and fixing a legacy-cache alias/data-loss edge case. The exact tested file tree was verified after upload. Fresh GitHub CI and human review are separate gates; #193 remains draft. No tag, release, npm publish or main merge has occurred. RC alignment/bootstrap and npm owner authentication/Trusted Publisher proof remain required.

The previous candidates remain open pending review of this replacement; their historical green tests are not reused as current-head evidence.

fix(npm): follow the registry identifier to the bytefolk namespace (#162

Source candidate: draft #193 (chore(release): prepare ByteFolk mem-mcp 0.1.2). I cannot complete the registry-write half from this environment: npm whoami is ENEEDAUTH, and this token has no npm org or Trusted Publishing bootstrap.

Existing @fullstack-ai-infra/mem-mcp@0.1.1 must stay installable. No tag, no publish, no deprecation, no unpublish from me. Tracking #193 plus parent bytefolk/.github#22.

0.1.2 rebase vehicle for G4/G5 identity: #222. Registry write still blocked on @bytefolk npm ownership (.github#22).

chore(release): prepare ByteFolk mem-mcp 0.1.2 (#153)

chore(release): prepare ByteFolk mem-mcp 0.1.2

feat(release): add OIDC workflow for official MCP Registry (G5)

chore(release): prepare ByteFolk mem-mcp 0.1.2

feat(release): add OIDC workflow for official MCP Registry (G5)

chore(release): rebase ByteFolk mem-mcp 0.1.2 and add MCP Registry OI…

docs(readme): sharpen project onboarding (#230)

Navigation Menu

Repository navigation

[Release] Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2 #153

Current decision (2026-09-10)

Outcome

Exact plan

Acceptance

Proposal: a minimal rewrite of this body, because it now contradicts the decision it is tagged `status:ready` under

Why this is not housekeeping

Paste-ready replacement for the top of the body

What I did not do here

Release decision — 2026-09-10

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Release] Migrate mem-mcp to @bytefolk/mem-mcp v0.1.2 #153

Description

Current decision (2026-09-10)

Outcome

Exact plan

Acceptance

Activity

waterbro-8 commented on Sep 6, 2026

Proposal: a minimal rewrite of this body, because it now contradicts the decision it is tagged status:ready under

Why this is not housekeeping

Paste-ready replacement for the top of the body

What I did not do here

PeterGuy326 commented on Sep 10, 2026

Release decision — 2026-09-10

PeterGuy326 commented on Sep 10, 2026

waterbro-8 commented on Sep 17, 2026

waterbro-8 commented on Sep 18, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Proposal: a minimal rewrite of this body, because it now contradicts the decision it is tagged `status:ready` under