Memory Sidecar v3.5.1 — Operational Hardening for Agent Memory Infrastructure

Memory Sidecar has become a critical component for agent‑agnostic memory in production AI workflows. Version 3.5.1 marks a deliberate shift from feature velocity to operational maturity, addressing real‑world pain points observed across deployments. This release introduces no new APIs or schemas; instead it hardens the runtime behaviour so you can rely on it under load, network churn, and adversarial conditions. Three areas received focused attention: connection resilience, caching, and observability. All are configurable via environment variables or mounted configuration files, allowing operators tune them per workload. When the backing memory store (e.g., Redis or a SQL backend) becomes unresponsive, the sidecar now uses a circuit breaker with exponential backoff retries. The circuit opens after a configurable consecutive failure threshold, rejecting requests immediately to prevent cascading timeouts. A half‑open state periodically probes the backend for recovery. Retries include jitter to avoid thundering herd. environment: MEMORY_SIDECAR_RETRY_MAX: "3" MEMORY_SIDECAR_RETRY_BASE_DELAY_MS: "500" MEMORY_SIDECAR_CIRCUIT_BREAKER_THRESHOLD: "5" MEMORY_SIDECAR_CIRCUIT_BREAKER_HALF_OPEN_AFTER_MS: "10000" These are the only knobs needed to protect both the sidecar and the upstream store. Read operations are the hot path for most agent interactions. v3.5.1 adds an LRU in‑memory cache with configurable TTL and per‑session namespacing. This reduces latency from milliseconds to microseconds for repeated lookups and lowers the load on the storage backend. The cache is disabled by default; enable it only after profiling your workload. MEMORY_SIDECAR_CACHE_ENABLED=true MEMORY_SIDECAR_CACHE_SIZE=10000 MEMORY_SIDECAR_CACHE_TTL_SECONDS=300 Namespacing ensures that session‑specific data cannot be served to another session, even under cache collisions. Every gRPC handler now emits structured logs with a trace ID that can be propagated from the agent. Prometheus metrics are exposed at /metrics covering request latency histograms, cache hit/miss ratios, circuit breaker state transitions, and connection pool utilisation. Dedicated /healthz and /readyz endpoints reflect the health of the backend connection, the cache, and the sidecar’s internal state. TLS is enforced by default for all gRPC connections. API key authentication is mandatory; the key must be provided via the MEMORY_SIDECAR_API_KEY environment variable or a file mounted at /etc/memory-sidecar/key. Debug endpoints have been stripped from production builds. If you deploy via hermes-memory-installer, v3.5.1 is now the default image for new installations. Existing deployments can update the image tag and add the new environment variables. The configuration schema is backwards compatible, but note that an absent MEMORY_SIDECAR_API_KEY will cause the sidecar to fail at startup — check your secrets before rolling out. This is a pure hardening release. There are no new memory operations, no schema changes, and no breaking protocol shifts. Upgrade to reduce operational friction and gain the observability you need to debug agent memory behaviour in production.