# AIStor Memory (aimem) RELEASE.2026-09-24T13-48-28Z Released: 2026-09-24 The `aimem bio` telemetry collector now creates its own tables, answers `200` only once a payload is safely on disk, stores GenAI messages and histogram values as queryable columns, and exports tables to Parquet for DuckDB and Spark. `aimem bio provision` is removed, so check your collector scripts and credentials before upgrading; this release also fixes stale reads when one descriptor reads a file while another rewrites it. --- ## Downloads ### Binaries | Platform | Architecture | Download | | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------ | | Linux | amd64 | [aimem.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem.RELEASE.2026-09-24T13-48-28Z) | | Linux | arm64 | [aimem.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem.RELEASE.2026-09-24T13-48-28Z) | The setuid `aimem-fusermount` mount helper, the `aimem-bio` binary that `aimem bio` runs, and the Kubernetes CSI node driver are published beside it: | Binary | Architecture | Download | | ------------------ | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem-fusermount` | amd64 | [aimem-fusermount.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-fusermount.RELEASE.2026-09-24T13-48-28Z) | | `aimem-fusermount` | arm64 | [aimem-fusermount.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-fusermount.RELEASE.2026-09-24T13-48-28Z) | | `aimem-bio` | amd64 | [aimem-bio.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-bio.RELEASE.2026-09-24T13-48-28Z) | | `aimem-bio` | arm64 | [aimem-bio.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-bio.RELEASE.2026-09-24T13-48-28Z) | | `aimem-csi-driver` | amd64 | [aimem-csi-driver.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-csi-driver.RELEASE.2026-09-24T13-48-28Z) | | `aimem-csi-driver` | arm64 | [aimem-csi-driver.RELEASE.2026-09-24T13-48-28Z](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-csi-driver.RELEASE.2026-09-24T13-48-28Z) | Each binary has `.sha256sum`, `.minisig`, and `.asc` files at the same path. These links point into `archive/`, where a release's files stay after a newer release ships, so they always serve this build. The unversioned `…/linux-{arch}/aimem` path serves whatever release is newest. ### Packages `.deb`, `.rpm`, and `.apk` install the `aimem` client, the setuid `aimem-fusermount` mount helper (`/usr/bin/aimem-fusermount`, mode 4755), and `aimem-bio`. They also install a disabled example `mnt-aimem.mount` systemd unit and the `/sbin/mount.aimem` helper it needs. | Format | Architecture | Download | | ------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | DEB | amd64 | [aimem\_20260924134828.0.0_amd64.deb](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260924134828.0.0_amd64.deb) | | DEB | arm64 | [aimem\_20260924134828.0.0_arm64.deb](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260924134828.0.0_arm64.deb) | | RPM | amd64 | [aimem-20260924134828.0.0-1.x86_64.rpm](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem-20260924134828.0.0-1.x86_64.rpm) | | RPM | arm64 | [aimem-20260924134828.0.0-1.aarch64.rpm](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem-20260924134828.0.0-1.aarch64.rpm) | | APK | amd64 | [aimem\_20260924134828.0.0_x86_64.apk](https://dl.min.io/aistor/aimem/release/linux-amd64/archive/aimem_20260924134828.0.0_x86_64.apk) | | APK | arm64 | [aimem\_20260924134828.0.0_aarch64.apk](https://dl.min.io/aistor/aimem/release/linux-arm64/archive/aimem_20260924134828.0.0_aarch64.apk) | The packages depend only on libc (`libc-bin` / `glibc-common`); no `libfuse` is needed. ### Container Images ```bash # The aimem client, pinned to this release: docker pull quay.io/minio/aistor/aimem:RELEASE.2026-09-24T13-48-28Z # The Kubernetes CSI node driver, pinned to this release: docker pull quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-24T13-48-28Z ``` `quay.io/minio/aistor/aimem:latest` also points at this release, but moves when the next one ships. To verify a build, pin the release tag or a `@sha256:` digest, never `latest`. Mounting from a container needs `/dev/fuse` and `CAP_SYS_ADMIN` (or `--privileged`). ### Verification Each binary is signed with minisign (preferred) and GPG, and has a sha256sum file. ```bash BASE=https://dl.min.io/aistor/aimem/release/linux-amd64/archive curl -fsSLO $BASE/aimem.RELEASE.2026-09-24T13-48-28Z curl -fsSLO $BASE/aimem.RELEASE.2026-09-24T13-48-28Z.minisig curl -fsSLO $BASE/aimem.RELEASE.2026-09-24T13-48-28Z.sha256sum # minisign minisign -Vm aimem.RELEASE.2026-09-24T13-48-28Z \ -P RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav # sha256: the checksum file names the versioned binary, so keep that file name sha256sum -c aimem.RELEASE.2026-09-24T13-48-28Z.sha256sum ``` The minisign public key above is the MinIO release-signing key, used across the AIStor product line. --- ## Changes since RELEASE.2026-09-23T02-59-13Z ### New Features - **The collector creates the agent's telemetry tables itself.** Before it publishes its endpoint, `aimem bio serve` creates the agent's namespace and its seven tables if they are missing, and checks any that exist. There is no separate provisioning step, and the credential the Memory Bucket issues when an agent is created is enough to run it. (#221) - **`--session-key` names the agent's session-id attribute.** Pass it to `aimem bio serve` (or set `AIMEM_BIO_SESSION_KEY`) when the collector runs under the agent's own credential, which cannot read the agent record. A mount that runs the collector takes it as `--bio-session-key` or the `bio_session_key:` config key. `aimem bio ingest` accepts `--session-key` too, defaulting to `session.id`. (#221, #223) - **A `200` from the collector now means the payload is on disk.** Accepted payloads are written to a local spool and fsynced before the response is sent, and anything still in the spool is delivered when the collector next starts. A crash or restart no longer loses acknowledged telemetry. (#222) - **A slow Memory Bucket no longer causes `503`s.** When memory fills, new payloads wait in the spool instead of being refused. The collector answers `503` only when the spool is full or cannot be written. (#222) - **GenAI messages and tool definitions are stored as JSON columns.** Spans, span events and logs gain `gen_ai_input_messages`, `gen_ai_output_messages`, `gen_ai_system_instructions` and `gen_ai_tool_definitions`, so SQL can query them without unpacking the attribute map. (#223) - **Histogram points have typed columns.** `otel_metric_points` gains `count`, `sum`, `min`, `max`, `bucket_counts` and `explicit_bounds`, so token usage and durations can be aggregated without parsing JSON. (#219) - **Existing tables gain the new columns in place.** The next time the collector starts, it adds the columns above to tables created by earlier releases; earlier rows read them as null. No table needs to be dropped. (#223) - **`aimem bio export` writes a table to Parquet.** DuckDB and Spark cannot read the tables' nanosecond timestamps directly. The export writes every row with microsecond timestamps, keeps the exact value in a `_unix_nano` column, and takes the same `--table` and `--where` options as `aimem bio query`. (#223) ### Bug Fixes #### Filesystem - A file opened for reading kept returning its old contents while another descriptor rewrote it, and could keep returning them after the writer closed. Readers now see the writer's data, as POSIX requires, except a reader served by FUSE passthrough, which still sees the version it opened. (#220) - A reader duplicated with `dup()` could fail with `EBADF` after a writer that changed nothing closed the same file, and `stat` could report a file's old size after it was truncated. (#220) - `open()` with `O_TRUNC` on a file another descriptor was writing did not truncate it until the first write, so `stat` and new readers saw the old contents, and the delayed truncate could erase data the other writer wrote after the open. (#218) #### Telemetry collector - `aimem run` could fail to start the telemetry collector on every later attempt after the collector crashed during startup, or when its old process ID had been reused by another user. (#210) ### Behaviour Changes - **`aimem bio provision` is removed.** Delete it from scripts and deployment manifests; `aimem bio serve` now creates the tables itself. (#221) - **The collector credential needs more permissions if you built it by hand.** Add `s3tables:CreateNamespace`, `s3tables:GetNamespace`, `s3tables:CreateTable` and `s3tables:DeleteTable`, limited to the agent's namespace, and do not grant `s3tables:UpdateNamespaceProperties`. The credential the Memory Bucket issues when an agent is created already has what is needed. The [operations guide](https://docs.min.io/aimem/operations#scoping-a-collector-to-one-agent) has the full policy. (#221) - **The collector refuses a namespace that belongs to another agent**, and exits if an existing table does not match the schema it writes. (#221) - **The collector keeps a spool on disk.** It defaults to `.spool` beside the endpoint file; set `--spool-dir` or `AIMEM_OTLP_SPOOL_DIR` to move it. For a collector a mount starts, that is `.aimem/otlp/endpoint.spool` inside the `--local` store, and cache eviction never frees it. Under a tmpfs such as `/run` the spool survives a collector crash but not a host reboot. Its files hold prompts and tool output and are readable only by the collector's user. New limits `AIMEM_OTLP_SPOOL_MAX_BYTES` (default 1 GiB) and `AIMEM_OTLP_SPOOL_MAX_COUNT` (default 100000) decide when the endpoint refuses; `AIMEM_OTLP_MAX_BUFFER_BYTES` and `AIMEM_OTLP_MAX_BUFFER_COUNT` now bound memory only. The summary the collector prints on exit adds `spooled_payloads` and `spooled_bytes`. (#222) ### Platform / Compatibility - Linux amd64 and arm64, glibc 2.34 or later. - Mounting needs `/dev/fuse`. FUSE passthrough also needs `CAP_SYS_ADMIN`; without it, a mount serves ordinary FUSE reads. --- ## Security & Compliance Software bills of materials (SBOMs) for this release, generated from the `Cargo.lock` files at the release tag: | Component | SPDX | CycloneDX | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `aimem` | [aimem-RELEASE.2026-09-24T13-48-28Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-24T13-48-28Z.spdx.json) | [aimem-RELEASE.2026-09-24T13-48-28Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-24T13-48-28Z.cdx.json) | | `aimem-bio` | [aimem-bio-RELEASE.2026-09-24T13-48-28Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-24T13-48-28Z.spdx.json) | [aimem-bio-RELEASE.2026-09-24T13-48-28Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-bio-RELEASE.2026-09-24T13-48-28Z.cdx.json) | | `aimem-csi-driver` | [aimem-csi-RELEASE.2026-09-24T13-48-28Z.spdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-24T13-48-28Z.spdx.json) | [aimem-csi-RELEASE.2026-09-24T13-48-28Z.cdx.json](https://dl.min.io/aistor/aimem/release/notes/aimem-csi-RELEASE.2026-09-24T13-48-28Z.cdx.json) | The `aimem` dependency list is also published as plain text: [crate list](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-24T13-48-28Z.crates.txt) and [dependency tree](https://dl.min.io/aistor/aimem/release/notes/aimem-RELEASE.2026-09-24T13-48-28Z.cargo-tree.txt). --- ## Upgrade Instructions - **Upgrading from a release before RELEASE.2026-09-23T02-59-13Z?** Read the [RELEASE.2026-09-23T02-59-13Z notes](https://dl.min.io/aistor/aimem/release/notes/release-notes-RELEASE.2026-09-23T02-59-13Z.md) too. They cover the `aimem cortex` → `aimem bucket` rename, which this release also contains. - **Remove `aimem bio provision` from your scripts.** Start `aimem bio serve` directly; it creates what it needs. - **Check the collector's credential.** Use the credential the Memory Bucket issued for the agent, or add the permissions listed under Behaviour Changes to a hand-built policy. If that credential cannot read the agent record, pass `--session-key` (or `--bio-session-key` on the mount). - **Decide where the spool lives.** To keep acknowledged telemetry across a host reboot, point `--spool-dir` at persistent storage, and size the volume for `AIMEM_OTLP_SPOOL_MAX_BYTES`. If the mount runs the collector, the spool shares the `--local` disk, so leave up to that much (1 GiB by default) free on it. - **Make sure exporters retry `503`.** The collector has not taken a payload when it answers `503`; an exporter that treats it as final loses that payload. - **Kubernetes:** set the CSI node driver image to `quay.io/minio/aistor/aimem-csi-driver:RELEASE.2026-09-24T13-48-28Z`, which includes this `aimem`. ## Documentation - Hosted docs: ## Support - Security disclosures: security@min.io - Licensed customers and contributors: contact MinIO support.