{"record":{"id":"6cda2baa9db7b94a","repo":"zeroclaw-labs/zeroclaw","slug":"purge-session-not-supported-by-this-memory-backend","errorCode":null,"errorMessage":"purge_session not supported by this memory backend","messagePattern":"purge_session not supported by this memory backend","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"crates/zeroclaw-api/src/memory_traits.rs","lineNumber":328,"sourceCode":"    /// Remove the row matching `(key, agent_id)`. Siblings of the same key\n    /// under other agents are untouched. Returns `true` if a row was\n    /// removed. Required: no safe default exists for backends or wrappers\n    /// that can hold more than one row per `key` — the unscoped `forget`\n    /// would destroy sibling rows.\n    async fn forget_for_agent(&self, key: &str, agent_id: &str) -> anyhow::Result<bool>;\n\n    /// Remove all memories whose `namespace` field equals the given value.\n    /// Returns the number of deleted entries.\n    /// Default: returns unsupported error. Backends that support bulk deletion override this.\n    async fn purge_namespace(&self, _namespace: &str) -> anyhow::Result<usize> {\n        anyhow::bail!(\"purge_namespace not supported by this memory backend\")\n    }\n\n    /// Remove all memories in a session.\n    /// Returns the number of deleted entries.\n    /// Default: returns unsupported error. Backends that support bulk deletion override this.\n    async fn purge_session(&self, _session_id: &str) -> anyhow::Result<usize> {\n        anyhow::bail!(\"purge_session not supported by this memory backend\")\n    }\n\n    /// Remove all memories in a session for one agent.\n    /// Returns the number of deleted entries.\n    /// Default: returns unsupported error. Backends with per-agent storage\n    /// override this; agent-scoped wrappers use it instead of composing a\n    /// session list with key-only deletes.\n    async fn purge_session_for_agent(\n        &self,\n        _session_id: &str,\n        _agent_id: &str,\n    ) -> anyhow::Result<usize> {\n        anyhow::bail!(\"purge_session_for_agent not supported by this memory backend\")\n    }\n\n    /// Remove every memory row attributed to the given agent alias.\n    /// Returns the number of deleted entries. Called when an agent alias is\n    /// removed from `[agents.<alias>]` so the database doesn't accumulate","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-api/src/memory_traits.rs#L310-L346","documentation":"verify_checksum_bytes (src/commands/update.rs:534) SHA-256-hashes the downloaded archive bytes and compares (case-insensitively) against the digest recorded for that asset filename in the release's SHA256SUMS. A mismatch aborts the update before anything is written to staging — the bytes received are not the bytes the release published. As the message states, the realistic causes are a corrupted transfer (truncation, proxy/AV rewriting) or actual tampering (MITM); a stale checksum file after maintainers re-uploaded an asset is a rarer third cause.","triggerScenarios":"`zeroclaw update` on a release that publishes SHA256SUMS, where the downloaded archive's SHA-256 differs from the published digest: truncated download over a flaky link, TLS-inspecting proxy or antivirus altering the byte stream, MITM attack, or the asset was re-uploaded without regenerating SHA256SUMS.","commonSituations":"Corporate TLS-inspection proxies that rewrite content; AV download scanning stripping or modifying bytes; unreliable networks truncating the transfer; upstream publishing pipeline replacing an asset after generating checksums.","solutions":["Re-run `zeroclaw update` — transient corruption is fixed by a fresh download","If it persists, verify manually: download the archive and sha256sums from the release page and run `sha256sum -c --ignore-missing sha256sums` — a passing manual check means a middlebox is corrupting zeroclaw's in-band transfer","Retry from a different, trusted network or disable AV/proxy scanning for the github release hosts","If the manual check also fails, the published release is inconsistent or compromised — stay on your current version and report it to the maintainers"],"exampleFix":"# before\n$ zeroclaw update\nError: checksum mismatch for 'zeroclaw-x86_64-unknown-linux-gnu.tar.gz': expected abc..., got def.... The downloaded update may be corrupted or tampered with.\n\n# after\n$ # triage: does a manual download match the published digest?\n$ curl -fLO <release-url>/zeroclaw-x86_64-unknown-linux-gnu.tar.gz\n$ curl -fLO <release-url>/sha256sums\n$ sha256sum -c --ignore-missing sha256sums\nzeroclaw-x86_64-unknown-linux-gnu.tar.gz: OK   # -> network middlebox corrupted the in-flight copy; retry from a clean network","handlingStrategy":"retry","validationCode":"// Independent verification before trusting an update: fetch asset + sums\n// once and compare digests yourself, mirroring verify_checksum_bytes.\nasync fn download_intact(client: &reqwest::Client, asset_url: &str, sums_url: &str) -> anyhow::Result<bool> {\n    use sha2::{Digest, Sha256};\n    let bytes = client.get(asset_url).send().await?.bytes().await?;\n    let sums = client.get(sums_url).send().await?.text().await?;\n    let name = asset_url.rsplit('/').next().unwrap_or(\"\");\n    let expected = sums\n        .lines()\n        .find_map(|l| {\n            let (d, n) = l.split_whitespace().collect::<Vec<_>>()[..2].try_into().ok()?;\n            (n.trim_start_matches('*') == name).then_some(d)\n        })\n        .ok_or_else(|| anyhow::anyhow!(\"asset missing from SHA256SUMS\"))?;\n    Ok(hex::encode(Sha256::digest(&bytes)).eq_ignore_ascii_case(expected))\n}","typeGuard":null,"tryCatchPattern":"match update::run(version, force).await {\n    Err(e) if e.to_string().contains(\"checksum mismatch\") => {\n        // Retry ONCE on a fresh connection (transient corruption is common).\n        // A second identical mismatch is deterministic: stop, verify\n        // manually with sha256sum -c, and report possible tampering or a\n        // stale SHA256SUMS — do not keep re-downloading or force-install.\n    }\n    other => other,\n}","preventionTips":["Exclude github release download hosts from TLS-inspecting proxies and AV download scanning","Update over trusted networks; treat deterministic mismatches as a security signal, not noise","Verify checksums manually when performing offline/air-gapped installs"],"tags":["checksum","sha256","tampering","integrity","update","security"],"backgroundTag":"sha256-checksum-mismatch","analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}