Releases

Pre-indexed, signed Corpus Hub v2 pack for the rust-vulns record corpus.

content pin: ad69ad644a82d476c8618f76bf09db4f286d856e (records of 2026-11-06)
licence: CC0-1.0 (adapt-with-attribution)
definitions: 2903, files: 2
built by: xerj 1.0.0-rc.101

Use it: xerj hub pull rust-vulns. The archive is checked against the hub key (sha256, then ed25519 signature) before anything is extracted.

Built by https://github.com/xerj-org/xerj/actions/runs/42162585504 from tools/packs/rust-vulns/recipe.toml

The rust-vulns corpus pack, built and signed by the scheduled
pack publish workflow from tools/packs/rust-vulns/recipe.toml.

One release per build; under immutable releases a same-day
rebuild publishes under -r2, -r3, … instead of replacing
the day's earlier release. The newest is always at
https://github.com/xerj-org/xerj/releases?q=pack-rust-vulns
Build history lives in the releases themselves and in the
workflow runs.

Install (public key: tools/packs/keys/rust-vulns.pub in the repo):

xerj corpus add rust-vulns --from rust-vulns-pack.zip \
  --verify-sig rust-vulns.pub
xerj corpus index rust-vulns

rust-vulns-freshness.json carries the build date and record
count; the same 30-day staleness refusal that governs every
reference corpus governs this one.

The agent-session-trajectories corpus pack — the first
external-contributor pack on the hub (chunxiaoxx / Nautilus,
#1255; demand anchored to #1138, wishlist slot #1210). 70
sanitized multi-session agent trajectories with failure turns
kept verbatim, built and signed by the pack publish workflow
from tools/packs/agent-session-trajectories/recipe.toml.

One release per build; under immutable releases a same-day
rebuild publishes under -r2, -r3, … instead of replacing
the day's earlier release. The newest is always at
https://github.com/xerj-org/xerj/releases?q=pack-agent-session-trajectories

Install (public key: tools/packs/keys/agent-session-trajectories.pub in the repo):

xerj corpus add agent-session-trajectories \
  --from agent-session-trajectories-pack.zip \
  --verify-sig agent-session-trajectories.pub
xerj corpus index agent-session-trajectories

agent-session-trajectories-freshness.json carries the build
date and record count; the same 30-day staleness refusal that
governs every reference corpus governs this one.

Pre-indexed, signed Corpus Hub v2 pack for the agent-session-trajectories record corpus.

content pin: 13d0fbe1ac89198caf3d24ef622636c6b47edd32 (records of 2026-11-06)
licence: CC-BY-4.0 (adapt-with-attribution)
definitions: 70, files: 1
built by: xerj 1.0.0-rc.101

Use it: xerj hub pull agent-session-trajectories. The archive is checked against the hub key (sha256, then ed25519 signature) before anything is extracted.

Built by https://github.com/xerj-org/xerj/actions/runs/42162585504 from tools/packs/agent-session-trajectories/recipe.toml

[1.0.0-rc.101] - 2026-11-05

rc.101: XERJ-Query — the engine answers facts and counting questions from a
model that runs on CPU, off by default. This release ships XERJ-Query compiled
into the binary and serves it over /_facts on a node started with
--facts-model-dir <DIR>: write facts to a namespace, ask a natural-language
question, and read a verified answer with its cited evidence and the exact
program that produced it. Counting questions ("how many … over …?") are answered
by an exact executor, served only when two independently-seeded models agree on
the program. The model ships as a separate release asset, a swappable
xerj-model-bundle-v1 directory (FP16 weights, served on CPU with an int8-guard
encoding of the same weights — no GPU, nothing leaves the machine). On the honest
XERJ Score v2 (credit measured against Opus 5.5 = 100 on the facts + counting
evaluation) the shipped bundle, candidate_a_s47, scores 90.29 on the
standard eval — not the fresh/sealed set; robustness to new wordings and
fresh-set counting are not separately measured for this bundle. The engine serves
the evaluated bundle exactly: a byte-for-byte reproduction of its answers across
all 2,387 evaluation items. Without the flag a node is the node rc.100 was: no
/_facts route, no model load, the same MCP tool list.

Upgrade notes — read before starting rc.101 on an existing data directory

ONE-WAY DATA-DIRECTORY UPGRADE. rc.101 writes new segments as ZPS4 postings
and stores text columns as row-dictionary blocks by default. The first
flush moves the data directory to on-disk format 4; rc.100 and every
earlier build read only format 3 and refuse such a directory at open ("written
by a newer xerj"). A data directory that rc.101 has written to cannot be
opened by rc.100 again — take a backup or snapshot before the first start if
you may need to roll back. To keep writing format 3 postings, set
XERJ_FTS_POST_CODEC=packed before the first rc.101 start (and
XERJ_STORED_ROW_BLOCKS=0 to keep the old stored-text layout); the opt-in
positions-off text fields (index_options: docs|freqs) move the directory to
format 5. These defaults will be on public main before rc.102, so a later
public release opens rc.101 directories.
Provenance. The rc.101 binaries are built from a private tree: public
main at 3f6aefa8 plus the XERJ-Query engine lanes (storage, ingest, facts
wiring) plus the model crates xerj-infer, xerj-serve and xerj-exec,
which are licensed Proprietary and ship as binary + model bundle only.
Those three crates are not Apache-2.0 and are not in the public repository; the
Apache-2.0 LICENSE covers the engine source on main. The engine lanes
(non-proprietary) land on public main by pull request before rc.102.
XERJ-Query is opt-in. Nothing changes for a node started as before. The
flag is --facts-model-dir <DIR>; see the first entry under Added.

Added

XERJ-Query is opt-in. It ships compiled in and stays off until the server
is started with --facts-model-dir <DIR> (or XERJ_FACTS_MODEL_DIR; the
flag wins). Off, a node behaves as rc.100 did: every /_facts path answers
404 xerj_query_not_enabled naming the flag, no model loads and no facts
thread starts, the MCP tool list has no xerj_facts_ask (the published
schema is that default list), and memory namespaces and brains ending in
-facts are ordinary names again. On, everything below applies; xerj mcp
lists xerj_facts_ask when the node it proxies answers GET /_facts
(XERJ_MCP_FACTS=on|off decides instead).
Facts in the default build: /_facts, the xerj_facts_ask MCP tool, and
_ask with decline_v2 as the default rule (verify: served remains).
Read final_status and final_answer: under decline_v2 the plain status
and answer are the unchecked program's. Every _ask response now carries a
path field, facts or counting, and a counting answer reports its
program_sha256 and whether the partner model agreed. The /_facts status
no longer carries a "spike": true flag and reports the node's counting
state. Without a model directory XERJ-Query is off (see the entry above).
Exact counting answers in the default build. When the node is started with a
model bundle that carries a counting role (see "Model bundles" below), a
counting question is answered by an exact executor — the RC4 counting path
(stack v6) in xerj-infer and xerj_serve::counting — and served only when
the question routed to counting, its hard checks passed, and a partner model
produced the same program; otherwise the fact path answers under decline_v2.
The xerj ask CLI gains the matching count operation. COUNTING_OFF now
applies only when the bundle has no counting role, or its counting model is
absent or fails its load checks; in that case facts keeps serving and only
counting questions decline.
Known limitations of counting on rc.101 (measured on user-written facts):
counting engages only when every fact of the counted subjects carries a
stable subject_id (one per subject, on every fact about it); without it the
count is INCOMPLETE and the answer is UNKNOWN with path: "facts". The
op-set is set counts ("how many X have Y", optionally "distinct ");
sums, totals and numeric thresholds decline. A served count tallies the
members of the matched set and does not check the noun of the question:
"How many devices do the Berlin offices have in total?" over office = Berlin
facts with no devices relation is served as a verified count of people
(path: "counting", partner_agreement: true, the same program_sha256 as
"how many people have office Berlin"). Counting answers carry no evidence ids
by design, and the response names the program only by program_sha256. Ask
for the member type you mean and read a count as a member count.
Model bundles. --facts-model-dir (or XERJ_FACTS_MODEL_DIR) may point at a bundle directory
(bundle.json, schema xerj-model-bundle-v1) that holds a facts role and
optional counting/served and counting/partner roles, each a directory
with its own manifest.json and weights. A directory with no bundle.json
stays a plain facts export, as before. Replacing a single role is a directory
rename while the node is stopped, with no change to bundle.json or code;
load checks refuse a role whose weights or tokenizer hash does not match its
manifest, a served/partner pair that disagree, or an unknown rule name.
Serving precision is per role in bundle.json (XERJ_FACTS_PRECISION still
overrides facts); weights may be stored F32 or F16 and both widen to f32 at
load, so no serving path depends on how a model was trained. See
docs/MODEL_BUNDLE.md.
xerj-pagedir, page-pointer directories with self-checking reads. With
XERJ_AUTOINDEX_SOURCE_REF=1 and XERJ_SOURCE_REF_DIR set on client and
server, long JSONL fields stay in the original file; an edited file gives an
error, never wrong text. Off by default.
Opt-in hub answer evidence receipts (Refs #1789, #1786): Rust callers can
bind exact UTF-8 excerpts to pinned source bytes and export SHA-256/JCS
trace reports. MCP ask/def accepts trace identities through evidence;
unavailable source bytes or calibration explicitly abstain and escalate.
Default answer and hit wire fields are unchanged.
A pure Rust cyber scope guard (Refs #2767, #2769) with exact hostname/IP
allowlists, normalized CIDRs, inclusive authorization windows, explicit
repository-text taint refusal, and scope echoes. This is a shared planning
primitive, not a network scanner or a wired cyber recipe.
Opt-in advisory Claude Code search hints with xerj init --hooks on macOS/Linux
(Refs #2642): Grep/Glob and repeated Read can suggest a cited search scoped to
the indexed folder and configured loopback node, with a per-session quota.
--hooks --remove preserves other hooks and session memory.
The same advisory search hints for Gemini CLI with xerj init --hooks --host gemini on macOS/Linux (Refs #2642). It writes an AfterTool group to
.gemini/settings.json, because BeforeTool has no field that reaches the
model, and a millisecond timeout as that host expects. Matched tools are
grep_search, search_file_content, glob and read_file, anchored so MCP
tool names are not caught. Setup is refused when the host has hooks disabled.
Quotas, counters and backups are per host, and either host can be configured
or removed without touching the other.
Opt-in Claude Code session handoff with xerj init --memory on macOS/Linux
(Refs #2645). SessionEnd queues a background redacting import and lexical
autoindex; SessionStart returns bounded, cited historical excerpts from a
project memory namespace, with an offline cache. --memory --remove removes
only the owned hooks and retains data. Ordinary init and manual session
import are unchanged; Codex lifecycle hooks are not included in this first version.
Each queued delivery is isolated: terminal input refusals are retained in a
private rejected queue with recovery reasons, while transient failures retry.
Memory excerpts and displayed briefs filter Unicode controls and format marks.
A second Claude plugin in the xerj marketplace, xerj-knowledge, for
document search rather than code: a skill and /xerj-knowledge:index and
/xerj-knowledge:find commands that search local folders, notes, PDFs,
Office files and mail exports and cite the file and page. Same xerj mcp
server; the existing xerj plugin is unchanged. Untested in Claude Cowork
so far. (#2646)
A Nix flake: nix run github:xerj-org/xerj builds and runs xerj from
source, nix build produces it, and nix develop opens a shell with the
Rust toolchain. The package builds th...

Pre-indexed, signed Corpus Hub v2 pack for the rust-vulns record corpus.

content pin: a55004ac2beb45d0523d39e3abeeff3f70204914 (records of 2026-11-05)
licence: CC0-1.0 (adapt-with-attribution)
definitions: 2898, files: 2
built by: xerj 1.0.0-rc.100

Use it: xerj hub pull rust-vulns. The archive is checked against the hub key (sha256, then ed25519 signature) before anything is extracted.

Built by https://github.com/xerj-org/xerj/actions/runs/41967862042 from tools/packs/rust-vulns/recipe.toml

The rust-vulns corpus pack, built and signed by the scheduled
pack publish workflow from tools/packs/rust-vulns/recipe.toml.

One release per build; under immutable releases a same-day
rebuild publishes under -r2, -r3, … instead of replacing
the day's earlier release. The newest is always at
https://github.com/xerj-org/xerj/releases?q=pack-rust-vulns
Build history lives in the releases themselves and in the
workflow runs.

Install (public key: tools/packs/keys/rust-vulns.pub in the repo):

xerj corpus add rust-vulns --from rust-vulns-pack.zip \
  --verify-sig rust-vulns.pub
xerj corpus index rust-vulns

rust-vulns-freshness.json carries the build date and record
count; the same 30-day staleness refusal that governs every
reference corpus governs this one.

Pre-indexed, signed Corpus Hub v2 pack for lokdocsqr.

pinned: e17f591b71d02f51b0fe4f454e77fbfed0fbf4e6 (2026-11-03)
licence: Apache-2.0 (adapt-with-attribution)
definitions: 3070, files: 278
built by: xerj 1.0.0-rc.96

Use it: xerj hub pull lokdocsqr, or just ask a question. The archive is checked against the hub key (sha256, then ed25519 signature) before anything is extracted.

Built by https://github.com/xerj-org/xerj/actions/runs/41942468267

The agent-session-trajectories corpus pack — the first
external-contributor pack on the hub (chunxiaoxx / Nautilus,
#1255; demand anchored to #1138, wishlist slot #1210). 70
sanitized multi-session agent trajectories with failure turns
kept verbatim, built and signed by the pack publish workflow
from tools/packs/agent-session-trajectories/recipe.toml.

One release per build; under immutable releases a same-day
rebuild publishes under -r2, -r3, … instead of replacing
the day's earlier release. The newest is always at
https://github.com/xerj-org/xerj/releases?q=pack-agent-session-trajectories

Install (public key: tools/packs/keys/agent-session-trajectories.pub in the repo):

xerj corpus add agent-session-trajectories \
  --from agent-session-trajectories-pack.zip \
  --verify-sig agent-session-trajectories.pub
xerj corpus index agent-session-trajectories

agent-session-trajectories-freshness.json carries the build
date and record count; the same 30-day staleness refusal that
governs every reference corpus governs this one.

Pre-indexed, signed Corpus Hub v2 pack for the agent-session-trajectories record corpus.

content pin: 13d0fbe1ac89198caf3d24ef622636c6b47edd32 (records of 2026-11-05)
licence: CC-BY-4.0 (adapt-with-attribution)
definitions: 70, files: 1
built by: xerj 1.0.0-rc.100

Use it: xerj hub pull agent-session-trajectories. The archive is checked against the hub key (sha256, then ed25519 signature) before anything is extracted.

Built by https://github.com/xerj-org/xerj/actions/runs/41967862042 from tools/packs/agent-session-trajectories/recipe.toml

hub pack: rust-vulns @ ad69ad64

Uh oh!

rust-vulns corpus pack (pack-rust-vulns-2026-11-06)

Uh oh!

agent-session-trajectories corpus pack (pack-agent-session-trajectories-2026-11-06)

Uh oh!

hub pack: agent-session-trajectories @ 13d0fbe1

Uh oh!

xerj v1.0.0-rc.101

[1.0.0-rc.101] - 2026-11-05

Upgrade notes — read before starting rc.101 on an existing data directory

Added

Uh oh!

hub pack: rust-vulns @ a55004ac

Uh oh!

rust-vulns corpus pack (pack-rust-vulns-2026-11-05)

Uh oh!

hub pack: lokdocsqr @ e17f591b

Uh oh!

agent-session-trajectories corpus pack (pack-agent-session-trajectories-2026-11-05)

Uh oh!

hub pack: agent-session-trajectories @ 13d0fbe1

Uh oh!