enigma-memory 0.1.15 → 0.1.16

package/scripts/build-cloudflare-token-policy.mjs

@@ -167,8 +167,12 @@ export function buildCloudflareTokenPolicy(input = {}) {
   const domain = optionalText(input.domain, 'enigmamemory.com');
   const verificationCommands = [
     'npm run cloudflare:ops -- token verify --account-id <account-id>',
-    'npm run cloudflare:pages:packet -- --site ../github-upload/enigma-memory-site/_public_site --project-name enigma-memory --domain enigmamemory.com --live-url https://enigmamemory.com/ --expect-title Enigma',
-    'npm run production:handoff -- --site ../github-upload/enigma-memory-site/_public_site --project-name enigma-memory --domain enigmamemory.com --live-url https://enigmamemory.com/ --expect-title Enigma',
+    'npm run cloudflare:pages:stage',
+    'npm run cloudflare:pages:packet -- --site .enigma/cloudflare-pages/enigmamemory.com --project-name enigma-memory --domain enigmamemory.com --live-url https://enigmamemory.com/ --expect-title "Enigma"',
+    'npm run cloudflare:pages:dry-run',
+    'npm run cloudflare:pages:deploy',
+    'npm run cloudflare:ops -- --cloudflare-env-file <local-secret-file> pages verify --url https://enigmamemory.com/ --project-name enigma-memory --domain enigmamemory.com --cloudflare-live required',
+    'npm run production:handoff -- --site .enigma/cloudflare-pages/enigmamemory.com --project-name enigma-memory --domain enigmamemory.com --live-url https://enigmamemory.com/ --expect-title "Enigma"',
   ];
   if (includeMode(mode, 'hosted-probe')) {
     verificationCommands.splice(1, 0, 'npm run cloudflare:ops -- workers inspect-probe --name enigma-hosted-probe');

package/scripts/build-hosted-api-key-lifecycle.mjs

@@ -13,7 +13,7 @@ import {
 } from '../packages/hosted-cloud/src/index.js';
 
 export const HOSTED_API_KEY_LIFECYCLE_PACKET_SCHEMA = HOSTED_CLOUD_API_KEY_LIFECYCLE_PACKET_SCHEMA;
-export const HOSTED_API_KEY_LIFECYCLE_RELEASE_TARGET = '0.1.15';
+export const HOSTED_API_KEY_LIFECYCLE_RELEASE_TARGET = '0.1.16';
 
 const PROVIDED = 'provided';
 const BLOCKED = 'blocked_external_dependency';

package/scripts/build-hosted-customer-lifecycle.mjs

@@ -28,7 +28,7 @@ import {
 } from 'enigma-memory/hosted-cloud';
 
 export const HOSTED_CUSTOMER_LIFECYCLE_PACKET_SCHEMA = HOSTED_CLOUD_CUSTOMER_LIFECYCLE_PACKET_SCHEMA;
-export const HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET = '0.1.15';
+export const HOSTED_CUSTOMER_LIFECYCLE_RELEASE_TARGET = '0.1.16';
 
 const PROVIDED = 'provided';
 const BLOCKED_MISSING = 'blocked_missing_evidence';

package/scripts/build-installer-assets.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from 'node:url';
 
 export const INSTALLER_ASSET_SCHEMA = 'enigma.installer_assets.v1';
 export const INSTALLER_ASSET_PACKAGE = 'enigma-memory';
-export const INSTALLER_ASSET_VERSION = '0.1.15';
+export const INSTALLER_ASSET_VERSION = '0.1.16';
 export const INSTALLER_ASSET_GENERATED_AT = '1970-01-01T00:00:00.000Z';
 
 const SCRIPT_PATH = fileURLToPath(import.meta.url);

package/scripts/build-production-handoff-packet.mjs

@@ -224,7 +224,7 @@ function buildNextActions({ projectName, domain, credentialsPresent, pages, infr
     actions.push({
       id: 'deploy-current-static-site',
       owner: 'operator-or-ai-with-token',
-      command: `npm run cloudflare:ops -- pages deploy --site <local-site-dir> --project-name ${shellArg(projectName)} --execute`,
+      command: `npm run cloudflare:pages:stage && npm run cloudflare:ops -- pages deploy --site .enigma/cloudflare-pages/enigmamemory.com --project-name ${shellArg(projectName)} --execute`,
       evidence: `npm run cloudflare:ops -- pages verify --url ${shellArg(`https://${domain}/`)} --project-name ${shellArg(projectName)} --domain ${shellArg(domain)} --cloudflare-live required`,
     });
   }

package/scripts/build-production-unblocker.mjs

@@ -4,7 +4,7 @@ import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const PRODUCTION_UNBLOCKER_SCHEMA = 'enigma.production_unblocker.v1';
-export const CURRENT_PUBLIC_PACKAGE_VERSION = '0.1.14';
+export const CURRENT_PUBLIC_PACKAGE_VERSION = '0.1.15';
 
 const STATUS_VALUES = Object.freeze([
   'ready_now',

package/scripts/build-production-workplan.mjs

@@ -234,6 +234,8 @@ export function buildProductionWorkplan(inputs = {}, options = {}) {
   const endpointRefs = missingHostedEndpointRefs(hosted);
   const stateBlockers = hostedStateBlockers(hosted);
 
+  const finalDependencyCommand = 'npm run production:dependencies -- --goal-audit .enigma/goal-audit-current.json --release-audit .enigma/release-audit-current.json --worker-inspect .enigma/worker-inspect-result-current.json --whitepaper .enigma/whitepaper-claims-current.json --cloudflare-credentials .enigma/cloudflare-credentials-current.json --edge-deploy .enigma/edge-backend-deployment-current.json --edge-live .enigma/edge-backend-bootstrap-live-current.json --storage-bootstrap .enigma/cloudflare-storage-bootstrap-current.json';
+
   const phases = [
     makePhase({
       id: 'cloudflare_credentials',
@@ -309,7 +311,7 @@ export function buildProductionWorkplan(inputs = {}, options = {}) {
       owner: 'operator-or-reviewer',
       prerequisites: ['cloudflare_credentials', 'cloudflare_worker_permission', 'hosted_backend_refs', 'operator_acceptance', 'release_gates'],
       blockers: dependencyReport.launch_ready === true ? [] : ['launch_ready is false'],
-      commands: [release.next_command, staticSite.next_command, whitepaper.next_command, 'npm run production:goal-audit -- --site <public-site-dir> --domain enigmamemory.com --release-audit .enigma/release-audit-current.json', 'npm run production:dependencies -- --goal-audit .enigma/goal-audit-current.json --release-audit .enigma/release-audit-current.json --worker-inspect .enigma/worker-inspect-validation-current.json --whitepaper .enigma/whitepaper-claims-current.json --cloudflare-credentials .enigma/cloudflare-credentials-current.json --edge-deploy .enigma/edge-backend-deployment-current.json --edge-live .enigma/edge-backend-bootstrap-live-current.json --storage-bootstrap .enigma/cloudflare-storage-bootstrap-current.json'],
+      commands: [release.next_command, staticSite.next_command, whitepaper.next_command, 'npm run production:goal-audit -- --site <public-site-dir> --domain enigmamemory.com --release-audit .enigma/release-audit-current.json', finalDependencyCommand],
       evidence: [...release.evidence, ...staticSite.evidence, ...whitepaper.evidence],
       details: { goal_complete: dependencyReport.goal_complete === true, launch_ready: dependencyReport.launch_ready === true },
     }),

package/scripts/build-proof-network-packet.mjs

@@ -15,7 +15,7 @@ import {
   validateProofNetworkPacket,
 } from '../packages/proof-network/src/index.js';
 
-export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.15';
+export const PROOF_NETWORK_PACKET_RELEASE_TARGET = '0.1.16';
 
 const HASH_RE = /^(?:sha256:)?[a-f0-9]{64}$/iu;
 const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|\b(?:raw[\s_-]*memory|plaintext[\s_-]*prompts?|plain[\s_-]*text[\s_-]*prompts?|private[\s_-]*prompts?|provider[\s_-]*responses?|full[\s_-]*transcript|decrypted[\s_-]*memory|credentials?|secrets?|passwords?|private[\s_-]*keys?|api[\s_-]*key[\s_-]*(?:secret|material|value)|api[\s_-]*secrets?|access[\s_-]*tokens?|refresh[\s_-]*tokens?|token[\s_-]*values?|credential[\s_-]*material|tenant[\s_-]*names?)\b)/iu;

package/scripts/check.mjs

@@ -3,7 +3,9 @@ import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const packageJsonPath = path.join(root, 'package.json');
+const packageJsonPath = process.env.ENIGMA_CHECK_PACKAGE_JSON_OVERRIDE
+  ? path.resolve(process.env.ENIGMA_CHECK_PACKAGE_JSON_OVERRIDE)
+  : path.join(root, 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
 const productionRoots = [
   'packages/adapters/src/',

package/scripts/cloudflare-ops.mjs

@@ -6,6 +6,7 @@ import { dirname, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { promisify } from 'node:util';
 import { applyCloudflareSecretEnvFileFromArgv, CloudflareSecretEnvError } from './cloudflare-secret-env.mjs';
+import { PUBLIC_SITE_SECURITY_RESULT_SCHEMA, validatePublicSiteSecurity } from './validate-public-site-security.mjs';
 
 const execFile = promisify(execFileCallback);
 
@@ -46,6 +47,8 @@ Commands:
 
   pages deploy --site <dir> --project-name <name> [--execute]
       Without --execute, prints the exact Wrangler deploy plan only.
+      Dry-run output includes local public-site security validation.
+      --execute refuses artifacts with local security blockers before invoking Wrangler.
       With --execute, runs Wrangler through npm exec/npx without printing the token.
 
   pages verify --url <https-url> --project-name <name> [--domain <host>] \\
@@ -264,6 +267,35 @@ function redactPlanOutput(plan) {
   return redactOperationalPayload(plan);
 }
 
+function redactPublicSiteSecurityBlocker(entry) {
+  return {
+    message: redactOperationalText(entry?.message ?? ''),
+    ...(entry?.path === undefined ? {} : { path: redactOperationalText(String(entry.path)) }),
+  };
+}
+
+function publicSiteSecurityDeploySummary(result) {
+  return {
+    schema: PUBLIC_SITE_SECURITY_RESULT_SCHEMA,
+    ok: result?.ok === true,
+    status: result?.status ?? 'blocked',
+    blocker_count: Array.isArray(result?.blockers) ? result.blockers.length : 0,
+    blockers: Array.isArray(result?.blockers) ? result.blockers.map(redactPublicSiteSecurityBlocker) : [],
+    checked: redactOperationalPayload(result?.checked ?? {}),
+    claimBoundary: result?.claim_boundary ?? [],
+  };
+}
+
+function publicSiteSecurityErrorMessage(summary) {
+  const blockerText = summary.blockers
+    .slice(0, 5)
+    .map((entry) => (entry.path ? `${entry.path}: ${entry.message}` : entry.message))
+    .join('; ');
+  return blockerText.length > 0
+    ? `public site security validation blocked Pages deploy: ${blockerText}`
+    : 'public site security validation blocked Pages deploy';
+}
+
 function parsePositiveInteger(value, name) {
   const text = requireNonEmptyString(name, value);
   if (!/^\d+$/.test(text)) throw new UsageError(`${name} must be a positive integer`);
@@ -1518,6 +1550,7 @@ export async function runCloudflareOpsCommand(command, {
 
   if (command.kind === 'pages.deploy') {
     const plan = buildWranglerPagesDeployPlan(command);
+    const siteSecurity = publicSiteSecurityDeploySummary(await validatePublicSiteSecurity({ site: command.site }));
     if (!command.execute) {
       return {
         json: {
@@ -1526,10 +1559,12 @@ export async function runCloudflareOpsCommand(command, {
           dryRun: true,
           execute: false,
           plan: redactPlanOutput(plan),
+          siteSecurity,
           claimBoundary: 'Plan only; no Cloudflare Pages deployment was executed.',
         },
       };
     }
+    if (!siteSecurity.ok) throw new UsageError(publicSiteSecurityErrorMessage(siteSecurity));
     const result = await execFileImpl(plan.command, plan.args, { shell: plan.usesShell === true, windowsHide: true, maxBuffer: 10 * 1024 * 1024, env });
     return {
       json: {

package/scripts/collect-hosted-backend-live-evidence.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import https from 'node:https';
 import { createHash } from 'node:crypto';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
@@ -81,6 +82,42 @@ function redactProbeBody(value, path = 'probe.body') {
   return value;
 }
 
+export function localSimulationLoopbackFetch(url, init = {}) {
+  const parsed = new URL(url);
+  const host = parsed.hostname.toLowerCase();
+  if (parsed.protocol !== 'https:' || (host !== 'sim.enigmamemory.com' && !host.endsWith('.sim.enigmamemory.com'))) {
+    throw new Error('--local-simulation-loopback only supports https://*.sim.enigmamemory.com simulation probes');
+  }
+  const request = {
+    hostname: '127.0.0.1',
+    port: parsed.port || 443,
+    path: `${parsed.pathname}${parsed.search}`,
+    method: init.method || 'GET',
+    headers: init.headers,
+    rejectUnauthorized: false,
+    servername: parsed.hostname,
+  };
+  return new Promise((resolve, reject) => {
+    const req = https.request(request, (res) => {
+      const chunks = [];
+      res.on('data', (chunk) => chunks.push(chunk));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        resolve({
+          ok: res.statusCode >= 200 && res.statusCode < 300,
+          status: res.statusCode,
+          statusText: res.statusMessage || '',
+          url,
+          redirected: false,
+          text: async () => text,
+        });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
 async function fetchProbe(url, { fetchImpl = globalThis.fetch, observedAt }) {
   if (typeof fetchImpl !== 'function') throw new Error('global fetch is not available in this Node runtime');
   const response = await fetchImpl(url, {
@@ -189,6 +226,10 @@ function parseArgs(argv) {
     }
     if (!arg.startsWith('--')) throw new Error(`Unexpected argument: ${arg}`);
     const name = arg.slice(2);
+    if (name === 'local-simulation-loopback') {
+      flags.set(name, true);
+      continue;
+    }
     const value = argv[index + 1];
     if (!value || value.startsWith('--')) throw new Error(`${arg} requires a value`);
     flags.set(name, value);
@@ -198,7 +239,7 @@ function parseArgs(argv) {
 }
 
 function usage() {
-  return `Usage: node scripts/collect-hosted-backend-live-evidence.mjs --relay-url <https-base> --gateway-url <https-base> --refs-json <refs.json> --domain <domain> --environment-id <id> --cloud-provider <provider> --region <region> --owner <owner> --operator-decision go --operator-packet-ref <ref> --operator-approved-at <iso> --operator-approved-by <name> [--out <collection.json>] [--evidence-out <evidence.json>]\n\nCollects public HTTPS /livez and /readyz evidence for relay and gateway, then validates it with validate-hosted-backend-live. It never sends credentials and does not deploy infrastructure.\n`;
+  return `Usage: node scripts/collect-hosted-backend-live-evidence.mjs --relay-url <https-base> --gateway-url <https-base> --refs-json <refs.json> --domain <domain> --environment-id <id> --cloud-provider <provider> --region <region> --owner <owner> --operator-decision go --operator-packet-ref <ref> --operator-approved-at <iso> --operator-approved-by <name> [--out <collection.json>] [--evidence-out <evidence.json>] [--local-simulation-loopback]\n\nCollects public HTTPS /livez and /readyz evidence for relay and gateway, then validates it with validate-hosted-backend-live. It never sends credentials and does not deploy infrastructure. The --local-simulation-loopback flag is restricted to https://*.sim.enigmamemory.com local simulation probes with self-signed TLS and must not be used as production evidence.\n`;
 }
 
 async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fetch } = {}) {
@@ -212,6 +253,7 @@ async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fet
   const refs = await readJsonFile(refsPath);
   const environment = await maybeReadJsonFile(readFlag(flags, 'environment-json'));
   const operatorAcceptance = await maybeReadJsonFile(readFlag(flags, 'operator-acceptance-json'));
+  const selectedFetchImpl = flags.get('local-simulation-loopback') === true ? localSimulationLoopbackFetch : fetchImpl;
   const collection = await collectHostedBackendLiveEvidence({
     relayBaseUrl: readFlag(flags, 'relay-url'),
     gatewayBaseUrl: readFlag(flags, 'gateway-url'),
@@ -233,7 +275,7 @@ async function runCli(argv = process.argv.slice(2), { fetchImpl = globalThis.fet
     operatorApprovedAt: readFlag(flags, 'operator-approved-at'),
     operatorApprovedBy: readFlag(flags, 'operator-approved-by'),
     observed_at: readFlag(flags, 'observed-at') ?? new Date().toISOString(),
-    fetchImpl,
+    fetchImpl: selectedFetchImpl,
   });
   const collectionJson = `${JSON.stringify(collection, null, 2)}\n`;
   const evidenceJson = `${JSON.stringify(collection.evidence, null, 2)}\n`;

package/scripts/run-memory-benchmarks.mjs

@@ -832,6 +832,11 @@ export function runMemoryBenchmarkSuite(options = {}) {
       credentials_required: false,
       external_downloads_required: false,
       external_provider_calls: false,
+      llm_answer_accuracy_scored: false,
+      provider_api_calls_made: false,
+      api_spend_possible: false,
+      mem0_adapter_run: false,
+      external_competitor_adapters_run: false,
       raw_private_memory_plaintext_included: false,
       provider_deletion_claim: false,
       model_forgetting_claim: false,

package/scripts/run-standard-memory-benchmarks.mjs

@@ -37,6 +37,25 @@ export const STANDARD_MEMORY_BENCHMARK_METHODS = Object.freeze([
   }),
 ]);
 
+export const STANDARD_EXTERNAL_COMPETITOR_ADAPTERS = Object.freeze([
+  Object.freeze({
+    id: 'mem0',
+    name: 'Mem0',
+    status: 'not_run_requires_credentials_or_runtime',
+    target_type: 'external_adapter',
+    can_run_in_this_harness: false,
+    scores_included: false,
+    required_artifacts: Object.freeze([
+      'Mem0 platform credentials or open-source runtime',
+      'Pinned Mem0 SDK/package versions',
+      'Fixed extraction, update, retrieval, reset, model, and tool policy',
+      'Same reviewed dataset manifest, split, top-k, and scorer as Enigma rows',
+    ]),
+    official_doc: 'https://docs.mem0.ai/',
+    boundary_reason: 'The standard runner has no Mem0 credentials, SDK/runtime, fixed memory loop, reset policy, model/tool environment, or reviewed adapter scorer, so no Mem0 score is produced.',
+  }),
+]);
+
 const LOCOMO_SOURCE_URL = 'https://raw.githubusercontent.com/snap-research/locomo/main/data/locomo10.json';
 const LONGMEMEVAL_SOURCE_URLS = Object.freeze([
   'https://huggingface.co/datasets/xiaowu0162/longmemeval-cleaned/resolve/main/longmemeval_oracle.json',
@@ -121,6 +140,8 @@ function parseArgs(argv = process.argv.slice(2)) {
     } else if (arg === '--out') {
       options.out = requiredFlagValue(argv, index, arg);
       index += 1;
+    } else if (arg === '--dry-run') {
+      options.dry_run = true;
     } else if (arg === '--help' || arg === '-h') {
       options.help = true;
     } else {
@@ -147,6 +168,100 @@ function optionalPositiveInteger(value, name) {
   return positiveInteger(value, name);
 }
 
+function datasetPlanRows(options) {
+  const rows = [];
+  if (options.locomo !== undefined || options.locomoPath !== undefined) {
+    rows.push({
+      id: 'locomo',
+      label: 'LoCoMo',
+      local_file_name: publicFileName(options.locomo ?? options.locomoPath),
+      source_url: LOCOMO_SOURCE_URL,
+      license: 'CC BY-NC 4.0',
+      sample_limit: optionalPositiveInteger(options.max_locomo_qa ?? options.maxLocomoQa, 'max_locomo_qa') ?? null,
+      parser: 'conversation session turns as memory records; qa evidence labels score support only',
+    });
+  }
+  if (options.longmemeval !== undefined || options.longmemevalPath !== undefined || options.longMemEvalPath !== undefined) {
+    rows.push({
+      id: 'longmemeval',
+      label: 'LongMemEval',
+      local_file_name: publicFileName(options.longmemeval ?? options.longmemevalPath ?? options.longMemEvalPath),
+      source_url: LONGMEMEVAL_SOURCE_URLS,
+      license: 'Review upstream Hugging Face dataset card and LongMemEval repository terms.',
+      sample_limit: optionalPositiveInteger(options.max_longmemeval_items ?? options.maxLongMemEvalItems, 'max_longmemeval_items') ?? null,
+      parser: 'haystack_sessions turns as memory records; answer-session labels score support only',
+    });
+  }
+  return rows;
+}
+
+function offlineCommandBoundaries({ scoresIncluded, datasetFilesRead }) {
+  return {
+    deterministic_offline_runner: true,
+    dataset_files_read_from_local_disk: datasetFilesRead,
+    network_calls_made: false,
+    provider_api_calls_made: false,
+    api_spend_possible: false,
+    hosted_memory_service_called: false,
+    external_competitor_adapters_run: false,
+    mem0_adapter_run: false,
+    llm_used: false,
+    llm_answer_accuracy_scored: false,
+    retrieval_evidence_proxy_scored: scoresIncluded,
+    benchmark_scores_included: scoresIncluded,
+    raw_question_text_included: false,
+    raw_answer_text_included: false,
+    raw_conversation_text_included: false,
+    gold_labels_used_for_retrieval: false,
+    gold_labels_used_for_scoring: scoresIncluded,
+  };
+}
+
+function applesToApplesControls(topK) {
+  return {
+    same_top_k_for_all_methods: true,
+    top_k: topK,
+    same_parser_per_dataset: true,
+    same_local_records_per_dataset: true,
+    same_gold_evidence_labels_per_dataset_for_scoring_only: true,
+    local_deterministic_methods_only: true,
+    provider_runtime_fixed: false,
+    competitor_runtime_fixed: false,
+    answer_generator_fixed: false,
+    evaluator_model_fixed: false,
+  };
+}
+
+export function buildStandardBenchmarkDryRunPlan(options = {}) {
+  const topK = optionalPositiveInteger(options.top_k ?? options.topK, 'top_k') ?? 5;
+  const datasets = datasetPlanRows(options);
+  if (datasets.length === 0) throw new Error('Provide --locomo <path> and/or --longmemeval <path>');
+  return {
+    schema: 'enigma.standard_memory_benchmark_plan.v1',
+    generated_at: options.generated_at ?? new Date().toISOString(),
+    package: {
+      name: 'enigma-memory',
+      version: '0.1.16',
+    },
+    public_safe: true,
+    dry_run: true,
+    top_k: topK,
+    datasets_planned: datasets,
+    local_methods: STANDARD_MEMORY_BENCHMARK_METHODS.map((method) => ({ ...method })),
+    external_competitor_adapters: STANDARD_EXTERNAL_COMPETITOR_ADAPTERS.map((adapter) => ({
+      ...adapter,
+      required_artifacts: [...adapter.required_artifacts],
+    })),
+    command_boundaries: offlineCommandBoundaries({ scoresIncluded: false, datasetFilesRead: false }),
+    apples_to_apples_controls: applesToApplesControls(topK),
+    non_claims: [
+      'This dry run does not read dataset files and produces no benchmark score.',
+      'No provider APIs, hosted memory services, Mem0 runtime, competitor SDKs, LLM generators, or evaluator models are called.',
+      'A scored report requires a separate non-dry-run command against the exact local dataset files and hashes.',
+    ],
+  };
+}
+
 function publicFileName(path) {
   return path === undefined || path === null ? undefined : basename(String(path));
 }
@@ -995,7 +1110,7 @@ function buildSuiteReport(datasetRows, topK, options) {
     generated_at: options.generated_at ?? new Date().toISOString(),
     package: {
       name: 'enigma-memory',
-      version: '0.1.15',
+      version: '0.1.16',
     },
     public_safe: true,
     top_k: topK,
@@ -1010,6 +1125,8 @@ function buildSuiteReport(datasetRows, topK, options) {
       'No provider APIs, hosted runtimes, competitor SDKs, or external accounts are called by this runner.',
       'Rows are local deterministic methods only; no third-party competitor scores or benchmark-leadership claims are emitted.',
     ],
+    command_boundaries: offlineCommandBoundaries({ scoresIncluded: true, datasetFilesRead: true }),
+    apples_to_apples_controls: applesToApplesControls(topK),
     benchmark_boundaries: {
       official_dataset_files_required: true,
       credentials_required: false,
@@ -1032,15 +1149,20 @@ function buildSuiteReport(datasetRows, topK, options) {
       enigma_relevance_fallback: 'falls back to all local candidates only when no enhanced relevance signal exists, then applies deterministic local ranking and --top-k',
       provider_api_used: false,
       llm_used: false,
+      gold_labels_used_for_retrieval: false,
     },
     local_methods: STANDARD_MEMORY_BENCHMARK_METHODS.map((method) => ({ ...method })),
+    external_competitor_adapters: STANDARD_EXTERNAL_COMPETITOR_ADAPTERS.map((adapter) => ({
+      ...adapter,
+      required_artifacts: [...adapter.required_artifacts],
+    })),
     datasets: datasetRows,
     dataset_rows: datasetRows,
   };
 }
 
 function usage() {
-  return `Usage: node scripts/run-standard-memory-benchmarks.mjs [--locomo <path>] [--longmemeval <path>] [--max-locomo-qa <n>] [--max-longmemeval-items <n>] [--top-k <n>] [--out <path>]\n\nProduces schema ${STANDARD_MEMORY_BENCHMARK_SUITE_SCHEMA}. Raw question, answer, and conversation text are never written to the report. With --longmemeval and --max-longmemeval-items, the local top-level JSON array is streamed for hashing and only the requested sample items are parsed.`;
+  return `Usage: node scripts/run-standard-memory-benchmarks.mjs [--locomo <path>] [--longmemeval <path>] [--max-locomo-qa <n>] [--max-longmemeval-items <n>] [--top-k <n>] [--out <path>] [--dry-run]\n\nProduces schema ${STANDARD_MEMORY_BENCHMARK_SUITE_SCHEMA}. Raw question, answer, and conversation text are never written to the report. With --longmemeval and --max-longmemeval-items, the local top-level JSON array is streamed for hashing and only the requested sample items are parsed. Use --dry-run to print a public-safe offline execution plan without reading dataset files or producing scores.`;
 }
 
 async function main() {
@@ -1049,7 +1171,9 @@ async function main() {
     console.log(usage());
     return;
   }
-  const report = await runStandardMemoryBenchmarkSuiteFromFiles(options);
+  const report = options.dry_run
+    ? buildStandardBenchmarkDryRunPlan(options)
+    : await runStandardMemoryBenchmarkSuiteFromFiles(options);
   const serialized = `${JSON.stringify(report, null, 2)}\n`;
   if (options.out) {
     const outPath = resolve(options.out);

package/scripts/stage-cloudflare-pages-artifact.mjs

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+import { cp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { validatePublicSiteSecurity } from './validate-public-site-security.mjs';
+
+const STAGE_SCHEMA = 'enigma.cloudflare_pages_stage.v1';
+const DEFAULT_HEADERS = Object.freeze([
+  ['Permissions-Policy', 'camera=(), microphone=(), geolocation=()'],
+  ['Content-Security-Policy', "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://api.fontshare.com; font-src 'self' https://fonts.gstatic.com https://api.fontshare.com; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"],
+]);
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function parseArgs(argv = process.argv.slice(2)) {
+  const out = { site: null, out: null, help: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (token === '--help') out.help = true;
+    else if (token === '--site') out.site = argv[++i] ?? null;
+    else if (token === '--out') out.out = argv[++i] ?? null;
+    else throw new UsageError(`unknown argument: ${token}`);
+  }
+  if (out.help) return out;
+  if (typeof out.site !== 'string' || out.site.trim().length === 0) throw new UsageError('--site is required');
+  if (typeof out.out !== 'string' || out.out.trim().length === 0) throw new UsageError('--out is required');
+  return out;
+}
+
+function usage() {
+  return 'Usage: node scripts/stage-cloudflare-pages-artifact.mjs --site <dir> --out <dir>\n\nCopies a static Pages artifact to a local staging directory and overlays required Cloudflare security headers without mutating the source artifact.\n';
+}
+
+function headerName(line) {
+  const match = String(line).trim().match(/^([^:]+):\s*.+$/u);
+  return match ? match[1].trim().toLowerCase() : null;
+}
+
+function ensureRequiredHeaders(text) {
+  const normalized = String(text ?? '').replace(/\r\n/g, '\n');
+  const lines = normalized.length > 0 ? normalized.split('\n') : [];
+  let blockStart = -1;
+  let insertAt = -1;
+  const present = new Set();
+
+  for (let i = 0; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
+    if (blockStart === -1) {
+      if (trimmed === '/*') {
+        blockStart = i;
+        insertAt = lines.length;
+      }
+      continue;
+    }
+    if (i > blockStart && lines[i] && !lines[i].startsWith(' ') && !lines[i].startsWith('\t')) {
+      insertAt = i;
+      break;
+    }
+    const name = headerName(lines[i]);
+    if (name) present.add(name);
+  }
+
+  const missing = DEFAULT_HEADERS.filter(([name]) => !present.has(name.toLowerCase()));
+  if (missing.length === 0) return normalized.endsWith('\n') ? normalized : `${normalized}\n`;
+  const additions = missing.map(([name, value]) => `  ${name}: ${value}`);
+  if (blockStart === -1) {
+    return [`/*`, ...additions, '', normalized].join('\n').replace(/\n*$/u, '\n');
+  }
+  const nextLines = [...lines];
+  nextLines.splice(insertAt, 0, ...additions);
+  return nextLines.join('\n').replace(/\n*$/u, '\n');
+}
+
+function publicPathLabel(value, placeholder) {
+  const text = String(value ?? '');
+  return /^(?:[A-Za-z]:[\\/]|\\\\|\/)/u.test(text) ? placeholder : text;
+}
+
+function safeErrorMessage(error) {
+  return String(error?.message ?? error).replace(/[A-Z]:\\[^\r\n"']+/gi, '<local-path>');
+}
+
+export async function stageCloudflarePagesArtifact(input = {}) {
+  const source = resolve(String(input.site ?? ''));
+  const out = resolve(String(input.out ?? ''));
+  const generatedAt = input.generated_at ?? input.generatedAt ?? new Date().toISOString();
+  if (source === out) throw new UsageError('--out must be different from --site');
+  await rm(out, { recursive: true, force: true });
+  await mkdir(dirname(out), { recursive: true });
+  await cp(source, out, { recursive: true, dereference: false, force: true, errorOnExist: false });
+  const headersPath = resolve(out, '_headers');
+  let headers = '';
+  try {
+    headers = await readFile(headersPath, 'utf8');
+  } catch {
+    headers = '';
+  }
+  await writeFile(headersPath, ensureRequiredHeaders(headers), 'utf8');
+  const security = await validatePublicSiteSecurity({ site: out }, { generated_at: generatedAt });
+  return {
+    schema: STAGE_SCHEMA,
+    generated_at: generatedAt,
+    source_site: '<source-public-site>',
+    staged_site: publicPathLabel(input.out, '<staged-public-site>'),
+    headers_overlay: {
+      file: '_headers',
+      ensured: DEFAULT_HEADERS.map(([name]) => name),
+      source_mutated: false,
+    },
+    security: {
+      schema: security.schema,
+      ok: security.ok,
+      status: security.status,
+      blocker_count: security.blockers.length,
+      blockers: security.blockers,
+      checked: security.checked,
+    },
+    ok: security.ok,
+  };
+}
+
+async function main() {
+  try {
+    const args = parseArgs();
+    if (args.help) {
+      process.stdout.write(usage());
+      return 0;
+    }
+    const result = await stageCloudflarePagesArtifact(args);
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return result.ok ? 0 : 1;
+  } catch (error) {
+    process.stderr.write(`${safeErrorMessage(error)}\n`);
+    return 1;
+  }
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  process.exitCode = await main();
+}