@oomkapwn/enquire-mcp 3.9.0-rc.30 → 3.9.0-rc.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +26 -0
  2. package/README.md +4 -4
  3. package/dist/index.d.ts +1 -1
  4. package/dist/index.js +1 -1
  5. package/docs/COMPARISON.md +1 -1
  6. package/package.json +2 -2
package/CHANGELOG.md CHANGED
@@ -2,6 +2,32 @@
2
2
 
3
3
  All notable changes to this project will be documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
4
4
 
5
+ ## [3.9.0-rc.31] — 2026-05-30
6
+
7
+ > **TL;DR:** **Repo-page SLSA overclaim fix + structural guard (residual of overclaim #15).** A state-driven check of the GitHub repo page found the **About description still said "SLSA-3"** — the unenforced claim that overclaim #15 (rc.7) downgraded to "SLSA L2" across README/package.json/llms.txt/COMPARISON/STABILITY, and that rc.18 fixed on the social card. The About string lives ONLY on GitHub (no file → outside OIA Check 4d's scope), so it survived ~23 RCs. **Fixed the live About** (`gh repo edit` → "SLSA L2") and added a structural guard so it can't drift back: `tests/github-metadata-invariant.test.ts` now asserts the About carries no SLSA-level-above-2 claim. **1019 → 1020 tests** (+1 source `it()`, positive + NEGATIVE controls); no `src/` change.
8
+
9
+ **Patch — brand-integrity (repo metadata + invariant). Tests + docs only.**
10
+
11
+ ### Fixed
12
+
13
+ - **Repo About "SLSA-3" → "SLSA L2"** (residual instance of overclaim #15). `release.yml` runs `npm publish --provenance` = **SLSA Build L2** (L3 requires the isolated `slsa-framework/slsa-github-generator`). The GitHub About description was the last surface still asserting the higher level — corrected via `gh repo edit`. (Topics verified correct: all `REQUIRED_TOPICS` present incl. `openclaw`; About lead-in "The most advanced Obsidian MCP" intact.)
14
+
15
+ ### Added
16
+
17
+ - **`findSlsaOverclaim` analyzer + live assertion** in `tests/github-metadata-invariant.test.ts` — the About-description test now fails if the description claims SLSA-3 / L3 / L4 (tolerant of `SLSA-3`, `SLSA 3`, `SLSA Build L3`, `SLSA Level 3`, `SLSA L3`); `SLSA L2` / `SLSA-2` pass. This is the structural class-closer for the gap that let the overclaim live on GitHub-only metadata: OIA Check 4d guards in-repo claim files + the social SVG, but the repo About string had no guard until now. Positive + NEGATIVE controls + a false-positive guard ("3 transports / L3 caching" must NOT trip).
18
+
19
+ ### Method note
20
+
21
+ The change-driven sweep of overclaim #15 (rc.7) fixed every *file*; OIA Check 4d (rc.8) structurally guarded every *file* + the social SVG (rc.18). But the GitHub About/Topics metadata is not a file in the repo — it's reachable only via `gh api` — so it fell outside both. Same root shape the project keeps hitting: **a defense scoped to one surface type misses a sibling surface of a different type**. The fix extends the existing `github-metadata-invariant` (which already pulls live About/Topics) with the SLSA check, so the repo page is now covered by the same fail-loud apparatus as the files.
22
+
23
+ ### Files changed
24
+
25
+ - `tests/github-metadata-invariant.test.ts` (+`findSlsaOverclaim` + live assertion + NEGATIVE control), test-count claims 1019 → 1020 (README ×4, package.json, llms.txt, AGENTS, COMPARISON).
26
+ - live GitHub repo About (out-of-band via `gh repo edit`; not a tracked file).
27
+ - version bump 3.9.0-rc.30 → 3.9.0-rc.31.
28
+
29
+ ---
30
+
5
31
  ## [3.9.0-rc.30] — 2026-05-30
6
32
 
7
33
  > **TL;DR:** **Correction patch — overclaim instance #18.** A state-driven post-ship audit (after the multi-hour sandbox outage that interrupted rc.29) caught that the rc.29 CHANGELOG + CLAUDE.md cited social-card asset sizes carried over from the **first design attempt the EPERM outage ate**, not the files actually shipped: SVG claimed "9.7 KB → 11.8 KB" (real **7.3 KB** — it shrank), PNG claimed "188 KB → **49.5 KB**" (real **205 KB** — the 2× density render grew it). No gate catches KB annotations in CHANGELOG prose, so only a state-driven read found it. Corrected to be **size-agnostic** (drop drift-prone KB; keep the verified `1280×640`, which the audit confirmed correct). **Docs-only — zero `src/`, zero asset change, 1019 tests unchanged.**
package/README.md CHANGED
@@ -13,7 +13,7 @@
13
13
  [![CI](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/oomkapwn/enquire-mcp/actions/workflows/ci.yml)
14
14
  [![npm](https://img.shields.io/npm/v/@oomkapwn/enquire-mcp.svg?label=npm&color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
15
15
  [![downloads](https://img.shields.io/npm/dm/@oomkapwn/enquire-mcp.svg?color=cb3837)](https://www.npmjs.com/package/@oomkapwn/enquire-mcp)
16
- [![tests](https://img.shields.io/badge/tests-1019%20passing-brightgreen.svg)](#trust)
16
+ [![tests](https://img.shields.io/badge/tests-1020%20passing-brightgreen.svg)](#trust)
17
17
  [![stable](https://img.shields.io/badge/v3.8.x-stable-brightgreen.svg)](./STABILITY.md)
18
18
  [![build provenance](https://img.shields.io/badge/build_provenance-SLSA_L2-blue.svg)](https://slsa.dev/spec/v1.0/levels#build-l2)
19
19
  [![MCP](https://img.shields.io/badge/MCP-1.29-8A2BE2.svg)](https://modelcontextprotocol.io/)
@@ -46,7 +46,7 @@ Your Obsidian vault becomes **persistent, queryable long-term memory** for any M
46
46
  > 2. **Best-in-class retrieval.** Hybrid BM25 + multilingual embeddings + BGE cross-encoder reranker fused via RRF, scaled with HNSW + int8 quantization. The same IR stack a search startup would build — open-sourced, in one binary.
47
47
  > 3. **Zero cloud calls during serve.** Models cached locally (one-time download from HuggingFace). Your vault content never leaves your machine. Air-gap-safe by default.
48
48
 
49
- **44 tools · 19 MCP prompts · 1019 unit tests · 50+ languages · v3.8.x stable · semver-bound · MIT · npm build provenance (SLSA L2).**
49
+ **44 tools · 19 MCP prompts · 1020 unit tests · 50+ languages · v3.8.x stable · semver-bound · MIT · npm build provenance (SLSA L2).**
50
50
 
51
51
  ---
52
52
 
@@ -184,7 +184,7 @@ Auto-generated **[API reference at oomkapwn.github.io/enquire-mcp](https://oomka
184
184
  | **GraphRAG-light** (wikilink community detection via Louvain modularity) | ✅ **only here** | ❌ | ❌ |
185
185
  | **Standalone `.base` query execution** (works without Obsidian running) | ✅ **only here** | ❌ | ❌ delegates to Obsidian |
186
186
  | **HyDE retrieval** (Gao et al 2023) + sub-question decomposition | ✅ **only here** | ❌ | ❌ |
187
- | **1019 unit tests · 9 required + 4 advisory CI gates per PR** | ✅ | n/a | rare |
187
+ | **1020 unit tests · 9 required + 4 advisory CI gates per PR** | ✅ | n/a | rare |
188
188
  | **Signed build provenance** (npm + Sigstore, SLSA Build L2) | ✅ | n/a | ❌ |
189
189
  | **Semver-bound public surface** ([STABILITY.md](./STABILITY.md)) | ✅ | n/a | ❌ |
190
190
  | Standalone (no Obsidian plugin needed) | ✅ | ❌ requires Obsidian | varies |
@@ -294,7 +294,7 @@ Channel: `npm install @oomkapwn/enquire-mcp` → latest stable (`@latest` = v3.8
294
294
  ```bash
295
295
  git clone https://github.com/oomkapwn/enquire-mcp.git
296
296
  cd enquire-mcp && npm install
297
- npm test # full suite (1019 tests, ~12s)
297
+ npm test # full suite (1020 tests, ~12s)
298
298
  npm run lint # zero warnings
299
299
  npm run build # tsc → dist/
300
300
  ```
package/dist/index.d.ts CHANGED
@@ -7,7 +7,7 @@
7
7
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
8
8
  * `vault-info` resource payload).
9
9
  */
10
- export declare const VERSION = "3.9.0-rc.30";
10
+ export declare const VERSION = "3.9.0-rc.31";
11
11
  export { main } from "./cli.js";
12
12
  export { buildEmbedText, buildMcpServer, formatReadyBanner, prepareServerDeps, type ServeOptions, type ServerDeps, startServer } from "./server.js";
13
13
  export { parsePositiveInt, parseQuantizationMode } from "./tool-registry.js";
package/dist/index.js CHANGED
@@ -40,7 +40,7 @@ import { main } from "./cli.js";
40
40
  * + `McpServer({version})`) and `src/tool-registry.ts` (used in the
41
41
  * `vault-info` resource payload).
42
42
  */
43
- export const VERSION = "3.9.0-rc.30";
43
+ export const VERSION = "3.9.0-rc.31";
44
44
  // Re-exports — preserve the v3.5.x public surface so http-transport.ts and
45
45
  // tests don't need to know about the new module layout. The set below
46
46
  // exactly matches the v3.5.x `export` declarations: `main`,
package/docs/COMPARISON.md CHANGED
@@ -43,7 +43,7 @@ The four axes the external audit (#3, 2026-05) called out as decisive — **REST
43
43
  | Read open editor state, active note, etc. | **No** | **Yes** | Limited | No | No |
44
44
  | Zero outbound network calls in serve mode | **Yes** (default) | Local-only (REST)| Local-only (REST)| Yes | Yes |
45
45
  | Signed build provenance on releases (SLSA L2) | **Yes** | No | No | No | No |
46
- | Test count (public) | **1019** | (varies) | (varies) | (varies) | (varies) |
46
+ | Test count (public) | **1020** | (varies) | (varies) | (varies) | (varies) |
47
47
  | Tool count | 44 | ~25 | ~8 | ~10 | 3–5 |
48
48
  | MCP prompt count | 19 | 0 | 0 | 0 | 0 |
49
49
  | License | MIT | Apache-2.0 | MIT | MIT | (varies) |
package/package.json CHANGED
@@ -1,9 +1,9 @@
1
1
  {
2
2
  "$schema": "https://json.schemastore.org/package.json",
3
3
  "name": "@oomkapwn/enquire-mcp",
4
- "version": "3.9.0-rc.30",
4
+ "version": "3.9.0-rc.31",
5
5
  "mcpName": "io.github.oomkapwn/enquire-mcp",
6
- "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 44 tools, 19 MCP prompts, 1019 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
6
+ "description": "MCP server giving AI agents (Claude Code, Claude Desktop, Cursor, ChatGPT, Codex, OpenClaw) persistent long-term memory backed by your local Obsidian markdown vault. Hybrid retrieval (BM25 + ML embeddings + BGE reranker, RRF-fused), HNSW + int8 quantization, agentic RAG (HyDE + sub-question decomposition), GraphRAG-light (Louvain), standalone Obsidian Bases, PDFs + Tesseract OCR. Vendor-neutral memory layer for any MCP-compatible agent. 44 tools, 19 MCP prompts, 1020 tests, signed npm build provenance (SLSA L2), semver-bound, MIT, zero cloud calls during serve.",
7
7
  "type": "module",
8
8
  "bin": {
9
9
  "enquire-mcp": "dist/index.js"