v3.9.1

Release Notes — CORS Update

✅ Summary
This release updates only CORS configuration behavior. Core API routes and logic are unchanged.

✅ What’s New
Credentialed CORS enabled by default
Allows TSX apps to send cookies or use credentials: "include" without extra config.

Universal origin support via regex fallback
When no explicit origins are provided, the server uses allow_origin_regex=".*" to avoid invalid wildcard + credentials combinations.

Configurable via environment variables
Full control over allowed origins, headers, methods, exposed headers, and preflight cache time.

✅ Backward Compatibility
No route changes

No behavior changes to API responses

Only response CORS headers differ

✅ Why This Matters
This removes the most common browser‑side CORS failure in TSX apps:
credentialed requests with wildcard origin.

What's Changed

• Harden CORS wildcard handling when credentials are enabled by @kojibai in #2

New Contributors

• @kojibai made their first contribution in #2

Full Changelog: v3.9.0...v3.9.1

GlyphStream™ v3.9.0 — LAH-MAH-TOR Sync Edition

GlyphStream™ is now live: a global, convergent, multi-device “state stream” that works with no database, no accounts, no servers required on the client, and no parent pointers embedded in payloads—yet still reconstructs full lineage trees deterministically.

This release is the moment the web finally gets something it’s been missing since day one:

A shared, evolving, provenance-safe memory stream—built from URLs alone.

---

What shipped

1) Global state with no DB

GlyphStream™ maintains a complete, evolving registry of sigil/memory URLs using:

• In-memory registry for speed (Map-backed)
• localStorage persistence for survival across reloads
• BroadcastChannel sync for cross-tab coherence
• DOM events + a global hook so any part of the app can “register” a new glyph instantly

Result: your entire graph exists locally, deterministically, with zero backend dependency.

---

2) True thread reconstruction without embedding parent/origin in payloads

This release makes something “obvious in hindsight” finally real:

• Replies do not need to contain parentUrl or originUrl

• Instead, lineage is reconstructed from the witness chain:

  • #add= tokens (origin → … → parent)

• The Explorer derives originUrl + parentUrl in-registry (context layer)

• Trees render correctly even when payloads are “pure” and minimal

This is the core breakthrough:
Thread topology becomes deterministic metadata derived from the witness chain—NOT stored as mutable pointers.

---

3) Seamless Cloud Sync: every add becomes global (without changing your UX)

The Explorer now converges with the live base:

https://align.kaiklok.com

Two-way flow, zero friction:

A) Local → Cloud (Inhale)

Every time something is added locally:

• it is deduped by canonical URL
• batched into a krystal JSON file
• fail-soft uploaded to:

POST /sigils/inhale

No blocking UI. No “sync spinner required.” It just becomes true.

B) Cloud → Local (Seal → URLs)

Every φ-pulse cadence (~5.236s), the Explorer checks:

GET /sigils/seal

If the seal changed, it pulls:

GET /sigils/urls?offset=0&limit=...

…and imports anything new into your local GlyphStream™ registry.

✅ Important: Remote imports do not re-inhale back to the API.
No echo loops. No runaway duplication.

---

4) Kai-only ordering, Kai-native priority

The Explorer ranks the forest using Kai time only:

• Most recent pulse first

• Branch priority uses:

  1. latest Kai moment in the branch
  2. node count (bigger living trees rise)
  3. root time tie-breaker

No Chronos-based sorting. No wall-clock drift logic.

Polling cadence uses a ~5.236s interval strictly as a rhythm tick—not as a source of truth.

---

5) “Per-pulse Φ sent” visibility (signal on the stream)

Each node can surface the total Φ sent from that pulse across the registry, giving the stream a real economic/energetic trace layer:

• “Φ sent: …” rendered at node-level
• computed locally from registry, no DB queries required

---

6) Production-grade behaviors (the stuff that prevents slow death)

This release bakes in the details that make it durable:

• Canonical URL normalization (stable keys)
• Witness chain size caps (safety)
• Paging caps on remote pull (safety)
• Batched uploads + exponential backoff (resilience)
• Clipboard copy fallback (works everywhere)
• AbortController for polling cleanup (no leaks)
• Fail-soft parsing (bad entries don’t poison the stream)

---

Why this is a big deal (in plain truth)

Most systems pick one:

• Global (but needs accounts + DB + servers)
• Offline-first (but isolated and non-convergent)
• Threaded (but requires embedding pointers + centralized storage)

GlyphStream™ is the rare fourth category:

Global + Offline-first + Threaded + Stateless

It’s a stream that:

• exists locally as a deterministic registry
• syncs globally by seal, not by trust
• reconstructs lineage without storing parent pointers in payload
• scales by URLs and witness chains, not by fragile databases

This is how “memory” should work on the web.

---

API contract (what the Explorer now speaks)

Seal check

• GET https://align.kaiklok.com/sigils/seal
• Response: { "seal": "<string>" }

URL listing (paged)

• GET https://align.kaiklok.com/sigils/urls?offset=0&limit=200

• Response includes:

  • state_seal
  • urls[]
  • paging metadata

Inhale (upload batch)

• POST https://align.kaiklok.com/sigils/inhale

• Multipart form upload:

  • file=@sigils_<id>.json

---

Upgrade notes

• Drop-in replacement for src/pages/SigilExplorer.tsx
• No CSS changes required
• No payload format migration required
• Existing local registries will auto-hydrate and begin converging with the cloud

---

Known constraints (intentional)

• The Explorer does not use Chronos ordering.
• Remote pull is seal-driven, not timestamp-driven.
• Witness chain (#add=) is the authoritative topology hint when present.

---

What this enables next (immediate unlocks)

• Multi-device provenance streams that “just work”
• Shared lineage graphs without accounts
• Portable, exportable “stream state” as pure JSON URL sets
• Deterministic reconstruction of conversation trees from the web itself

---

Version stamp

SigilExplorer v3.9.0 — GlyphStream™ Launch / LAH-MAH-TOR Sync Edition
Base sync target: https://align.kaiklok.com

Full Changelog: https://github.com/kojibai/kairos_sigil_merge_api/commits/v3.9.0