v0.18.5 — Data-integrity & server-security hardening

Two adversarial reviews — of the memory-store + TUI and of the server/API + ecosystem surfaces — found sixteen real bugs the tests missed, including a CRITICAL taint-laundering in the SQLite memory backend. All fixed and regression-tested, plus opt-in auth for the HTTP server. (Sixth review in the series; 45 bugs found across eight surfaces so far.)

Security

• CRITICAL — SQLite memory backend no longer launders taint. The optional SQLite/FTS5 store had no provenance column, so a tainted memory came back clean on every read — the recall taint-label and the anti-laundering guarantees silently broke purely by choosing that backend. Provenance is now a first-class column (with a safe migration for existing stores).
• Entity-graph facts now pass the injection gate (recall reachable via the memory graph previously skipped it).
• HTTP handlers no longer leak internal exception text; routes are matched on the parsed path; malformed Content-Length → 400.
• Opt-in auth for the HTTP server. State-changing endpoints (/chat, /a2a, /webhook/*) can require a bearer token (CHIMERA_SERVER_TOKEN); the WhatsApp inbound webhook verifies its X-Hub-Signature-256 HMAC (CHIMERA_WHATSAPP_APP_SECRET). Both opt-in; see docs/security.md.

Fixed

• evolve export no longer trains on reward-hacked hollow (empty-diff) successes (drop_hollow_success, on by default).
• Memory store is crash-safe (atomic save) and resilient (skips a malformed record); ids are full-length UUIDs (no silent collision-overwrite); SQLite all() returns a stable order so prune keeps the right memories.
• Blank recall queries return nothing on every path; the TUI escapes user+model text (no markup crash / injection); the messaging gateway surfaces a crashed turn instead of "(no reply)"; MetaAgent.build() can enforce the tool allowlist.

Gate: ruff + mypy clean, 1396 passed / 3 skipped. pip install -U chimera-agent