# Trace v0.5.0 validation — 3 November 2026

This release improves installation and staging integration. These are recorded local checks, not a production accuracy score, security certification, or proof of complete erasure.

## Recorded checks

- Complete Python suite: **127 passed, zero failed, zero skipped**, in 166.23 seconds, Windows / Python 3.13.12, with Mem0 2.2.1, Qdrant client 1.18.0 and MCP 1.29.0 available. The suite covers reference backends, lifecycle faults, network errors, corrupted/incomplete evidence, append-only history, regression replay, staging dashboard guards, portable definitions, mapped HTTP APIs, and the new existing-Mem0 callback connector. Two dependency deprecation warnings came from optional NLP libraries.
- Final focused connection/distribution run: **17 passed**, in 7.60 seconds. Thirteen repeat the connection checks from the full suite; four additionally verify the single-download CI kit, Docker host configuration, installer ownership guard, and preservation of unrelated files during uninstall. Do not add 17 to 127 as though all were distinct tests.
- JavaScript SDK: **one Node HTTP integration test passed**, exercising real requests, namespace isolation, deletion, Origin rejection and missing inventory. No customer application or npm registry publication was involved.
- Windows frozen executable: fixed reference mode returned **PASS / exit 0**, broken reference mode **FAIL / exit 1**, four cases each. An actual official-SDK stdio MCP client initialized the installed executable, listed **15 tools**, and invoked `trace.inspect_target` successfully.
- Per-user installer: exercised with an isolated destination and no Start-menu mutation. The installed executable launched its real dashboard and restarted the existing isolated Mem0 sample. The native confirmation dialogs and every Windows/antivirus environment have not been independently certified. Downloads are unsigned.
- Docker: final Linux image built successfully, served the dashboard with HTTP 200 through a loopback-only published host port, generated host-side `docker exec -i` MCP configuration, and passed the four corrected reference cases. No image was published to a registry. Build it with the supplied Dockerfile/Compose configuration.
- Browser walkthrough: optional Mem0 installation and readiness; inventory-only connectivity check; coverage review; actual synthetic Mem0 run **PASS**, unrelated control preserved, cleanup complete. A deliberately faulty standalone stale-cache fixture returned **FAIL** with one residual cache and unresolved cleanup; it was saved as a regression. Bundle review/import and OpenAPI route listing were exercised. A one-ZIP CI kit was checked against the running packaged engine. Narrow-screen checks found no document-width overflow; labels, status announcements, skip navigation and local DM Sans remain in place. This is not a formal accessibility audit.

## Defect found and corrected

The first existing-Mem0 connector check was inconclusive because Mem0 cold-loaded optional NLP libraries on its first write and exceeded the request timeout. The connector now initializes that optional path before being served, without creating records. The real connector check and subsequent full suite passed. CI export was also changed from two automatic downloads to one archive, avoiding browser restrictions on multiple downloads.

## Evidence files

The source release includes `reports/test-results-v0.5.0.xml`, `reports/test-distribution-v0.5.0.xml`, `reports/test-mem0-connector-v0.5.0.xml`, `reports/windows-frozen-smoke.json`, `reports/docker-smoke-v0.5.0.json`, and `reports/managed-mem0-and-ui.json`. Runtime databases, optional environments, logs, secret files and browser-upload fixtures are excluded from release packaging. The CI example contains only disposable loopback target definitions and synthetic regression contracts.

## Limits that remain

The managed Mem0 service is a Trace-owned sample. The existing-Mem0 helper must be connected to the user's actual staging Memory instance to test that instance. Its active-memory and vector observations are two views of one store; history and graph memory remain excluded and no separate answer cache is observed. HTTP mappings rely on developer-reviewed namespace semantics and complete upstream inventories. They do not discover undisclosed stores.

Portable digests detect inconsistent edits; they are not trusted signatures. CI was generated and replayed locally; no workflow was run in a user's GitHub repository. Loopback targets need runner-local services or a self-hosted runner. Native signed installers, PyPI/npm publication, a hosted multi-tenant backend, native arbitrary-database connectors, production/customer validation, physical erasure, backups and model unlearning remain outside this release.

The distributed Qdrant three-peer receipt from v0.4.0 is historical validation of that local topology, not a newly repeated v0.5.0 cluster benchmark.