release: Immortal Memory v1.3.0 controlled source automation

[HeiGeAi]

Immortal Memory v1.3.0

v1.3.0 turns external knowledge intake into a controlled product capability while preserving the full Living Self architecture already present on main.

What changed

• Git commit history can be collected from explicitly registered roots. It reads commit metadata and messages, not repository file bodies.
• GitHub pull requests and issues can be collected read-only through an already authenticated gh CLI.
• Claude Web and ChatGPT official exports, plus explicit Cursor JSONL transcripts, can be imported locally.
• Every connector is disabled by default, limited to registered paths, incrementally deduplicated, and passed through credential-shape redaction before persistence.
• The control center reports each connector separately without returning local filesystem paths.
• Feishu Mail is shown as an explicit opt-in source.
• External-source state is included in portable recovery exports and enabled sources run in the normal orchestrator.

Compatibility

• Python 3.9 through 3.12 are covered by CI.
• macOS is the complete production target, including LaunchAgent automation.
• Linux supports the core CLI, HTTP bridge, MCP, collection, and tests. Scheduling must be configured separately.
• Native Windows is not a production target because the index lock uses fcntl.flock. WSL2 is the practical Windows path.
• Codex, Claude Code, terminal agents, and other local agents can consume the same bounded context through CLI, HTTP, or MCP.

Safety boundaries

• Registration and collection are local operations. GitHub collection does not fetch, push, comment, merge, or modify repository state.
• Chat exports are never discovered globally. A user must register an existing file or directory.
• A successful local recovery export is not automatically a share-safe artifact. Offsite delivery still requires encryption and a verified restore drill.
• A missing ChatGPT export is reported as disabled or skipped, not as success.

Verification contract

The release is accepted only after the private-data scan, Python compilation, smoke test, full regression suite, P0 scenarios, wheel installation in an isolated home, remote CI, and a clean-clone check all succeed.