Install, upgrade and backup

Two steps put memprove to work. The first is scripts/install.sh from a checkout of this repository (or from release binaries):

export LIBCLANG_PATH=/opt/homebrew/opt/llvm/lib              # macOS with Homebrew LLVM; Ubuntu: libclang-dev
export DYLD_FALLBACK_LIBRARY_PATH=/opt/homebrew/opt/llvm/lib
cargo fetch --locked                                        # downloads the crates once; the rest is offline
cargo build --offline --release -p memprove-cli -p memprove-daemon
scripts/install.sh --from-binaries target/release          # default prefix ~/.memprove
scripts/install.sh --prefix /opt/memprove --from-binaries target/release --write-profile

install.sh copies memprove and memproved into <prefix>/bin, runs memproved bootstrap once to issue the operator’s control token into <prefix>/operator-token (mode 0600), starts the daemon on <prefix>/data (bin/ensure-daemon.sh starts it again after a reboot), issues the agent’s token (mcp-read, mcp-write) into <prefix>/config/token and writes the data directory’s path into <prefix>/config/data-dir, installs this guide at <prefix>/share/guide.md with the binaries’ build in its first line, and writes bin/ct, a wrapper that runs memprove with that installation’s variables. memproved bootstrap is offline: it runs while no daemon holds the data directory’s lock, prints the first control token’s secret once, and stores only its SHA-256 digest; once an active control token exists it refuses, and memprove token create makes more. With the default prefix no environment variable is needed: memprove, the hook and the MCP server read ~/.memprove/config when nothing else names a configuration directory. With another prefix the three variables below must be set where the agent’s client is started; --write-profile writes the PATH line and them into the shell profile between marker comments (interactive runs ask; a non-interactive run without --write-profile or --no-write-profile only prints them). Run on an installation that exists, install.sh backs the data directory up (<prefix>/backups/<UTC>-<build>/, with SHA256SUMS), stops the daemon, replaces the binaries and starts it again (a daemon that was not running stays stopped after ledger verify).

memprove backup --out <DIR> and memprove restore --from <DIR> --data-dir <PATH> copy a data directory offline, with its checksums, while the daemon is stopped. memprove doctor checks an installation read-only: one PASS, WARN or FAIL line per check (the builds, the daemon, the modes, the token, the configuration directory, the context, the hook, the MCP entry, PATH, the guide, the ledger), exit 1 when a check fails.

From docs/guide.md at 2625064cbf0a · Markdown