Prepare and publish Persistent Memory MCP v0.3.0

[dannymaaz]

Objective

Publish Persistent Memory MCP v0.3.0 — Data Safety and Recovery — from the isolated, fully validated release commit, without pulling later post-v0.3 feature work into the package.

Immutable v0.3.0 source

The only valid release commit remains:

9e0a084dd9b179612082edef99e1c3c9bf563ffa

It is the release-only MCP v1 / FastMCP candidate validated by PR #89 / Quality #361. Current main is post-v0.3 MCP v2 and is not the v0.3.0 tag target.

GitHub Release — complete

PR #103 added the fail-closed GitHub Release publisher and was squash-merged after exact-head Quality #401 passed 16/16 jobs:

4fff71ec44a40d7d4d296d4ad0b30d39583ea8f3

Controlled publisher run 31979169557 completed successfully. It:

• checked out only 9e0a084dd9b179612082edef99e1c3c9bf563ffa;
• revalidated package 0.3.0, mcp>=1.28,<2 and FastMCP;
• built wheel/sdist and passed twine check;
• generated and verified SHA-256 checksums;
• passed clean-wheel installation and real installed v0.2.0 upgrade validation;
• created an annotated v0.3.0 tag and verified its remote target;
• created a draft Release with exactly wheel, sdist and SHA256SUMS;
• re-downloaded the draft assets and revalidated checksums/version/metadata;
• published the final non-draft, non-prerelease GitHub Release.

Verified annotated tag object:

v0.3.0 -> 9e0a084dd9b179612082edef99e1c3c9bf563ffa

Final Release:

https://github.com/dannymaaz/memory-mcp/releases/tag/v0.3.0

Verified assets:

• persistent_memory_mcp-0.3.0-py3-none-any.whl
• persistent_memory_mcp-0.3.0.tar.gz
• SHA256SUMS

GitHub also retains the validated publisher bundle as Actions artifact persistent-memory-mcp-v0.3.0-github-release (artifact id 9271883321, 30-day retention).

A second redundant trigger run was stopped by the existing-release guard before any build/tag/upload mutation. It did not overwrite or alter the successful Release.

Repository-side PyPI path — complete and connector-ready

PR #104 reconciled the repository after the GitHub Release, retired the one-time GitHub Release branch trigger, and added a narrowly scoped connector trigger for PyPI. Exact-head Quality #403 passed 16/16 jobs and PR #104 was squash-merged as:

fe2bed601f6f2f592e6fa857b8441b176579e4af

.github/workflows/publish-pypi.yml now:

• accepts manual release_tag=v0.3.0 or a push only to exact branch release/publish-pypi-v0.3.0;
• requires the final GitHub Release;
• requires v0.3.0 to resolve exactly to 9e0a084dd9b179612082edef99e1c3c9bf563ffa;
• downloads the existing GitHub Release wheel/sdist/SHA256SUMS instead of rebuilding;
• verifies checksums, package metadata and twine check;
• transfers only verified distributions to the isolated pypi job;
• retrieves them with actions/download-artifact@v8;
• publishes through PyPI Trusted Publishing/OIDC with id-token: write scoped only to the publish job;
• uses concurrency protection for v0.3.0 publication.

Do not create release/publish-pypi-v0.3.0 until the matching PyPI Trusted Publisher is configured. Branch creation itself can trigger the publish workflow.

Completed checklist

• package metadata 0.3.0 validated;
• release MCP compatibility constrained to mcp>=1.28,<2;
• release-only Quality #361 green;
• guarded GitHub Release publisher validated by Quality #401;
• annotated v0.3.0 created at the exact immutable commit;
• wheel, sdist and SHA256SUMS independently verified;
• final GitHub Release published from those exact assets;
• connector-ready PyPI handoff validated by PR Prepare guarded PyPI handoff after v0.3.0 GitHub Release #104 / Quality #403;
• repository docs reconciled with the public GitHub Release and exact remaining external steps.

Remaining controlled publication steps

• configure PyPI Trusted Publisher for owner dannymaaz, repository memory-mcp, workflow publish-pypi.yml, environment pypi;
• trigger the guarded PyPI workflow and publish the same verified GitHub Release wheel/sdist through OIDC;
• validate a clean public installation of persistent-memory-mcp==0.3.0 and smoke-test the documented CLI path;
• submit stable public package/release metadata to MCP Registry;
• record final PyPI/Registry URLs and evidence in this issue and Notion, then close Issue Prepare and publish Persistent Memory MCP v0.3.0 #53 / MEM-33.

Publication gate

Do not rebuild the distributions between GitHub Release and PyPI. External publication must use the exact checksum-verified wheel/sdist already attached to v0.3.0.

[dannymaaz]

Repository-side publication hardening completed on 2026-08-16: PR #102 recreated the actions/download-artifact@v8 update from current main, preserved EXPECTED_COMMIT=9e0a084dd9b179612082edef99e1c3c9bf563ffa and all release/PyPI guards, passed Quality #396 with 16/16 jobs successful, and was squash-merged as 029d843fc693204596fc2305f03edb99ed1f6a5c. Stale PRs #98 and #99 were closed as superseded. This does not change the immutable v0.3.0 release source or the remaining external publication sequence.