knosky 0.6.3 → 0.7.0

package/CHANGELOG.md

@@ -1,93 +1,149 @@
-# Changelog
-
-All notable changes to KnoSky. Versions are git-tagged on this repo.
-
-## [0.6.0] - 2026-07-02 -- Trust-root hardening, rendering at scale, adversarial red-team suite
-
-### Added
-- **Rendering engine at scale:** level-of-detail rendering, clustering, virtualization, and streaming for large single-repo graphs; a cross-repo graph concept and rendering for multi-repo sets.
-- **Adversarial red-team suite:** a full pass across four categories -- indexer/artifact safety, local trust root, rendering engine, protocol/schema -- now wired into CI as a required check on every PR, and into the release workflow as a hard gate before any `npm publish`. Findings, fixes, and accepted limitations are published in [RED-TEAM.md](RED-TEAM.md).
-- **Conditional publish gate:** the release workflow now runs the complete test suite (including the full red-team suite) before publishing; any failure blocks the release rather than proceeding silently.
-- **Real-world validation:** indexing and rendering validated at scale against a large real monorepo and a real 4-repo linked set with genuine cross-repo dependencies, plus an adversarial case with deliberately stale/conflicting policy data.
-- **Measurement infrastructure (advisory, offline, no telemetry):** a naive-vs-KnoSky-guided agent comparison protocol, and a harness to run the same benchmark simultaneously across multiple model families for independent comparison.
-- **Protocol Adoption Kit:** a start-here doc, a machine-readable protocol spec with schemas, a model-agnostic onboarding contract, and GitHub Action packaging reusing the PR-GPS pattern.
-- Comparison page and additional launch documentation under `wiki/`.
-
-### Security
-- **Trust-root hardening (Hardening Addendum 2):** full key rotation/revocation lifecycle. Two quorum-math edge cases are identified, fixed where fixable, and explicitly documented rather than hidden: the N=2 degenerate case (mathematically unavoidable at N=2 -- maintain N>=3 for real threshold protection) and the M=0 sole-remaining-key self-revocation case (an intentional design choice -- see SECURITY.md). The ledger high-water-mark guard is now correctly consumed by the freshness-attestation check it was built to protect.
-- **CI hardening:** a new AI-assisted security review runs on every pull request alongside the existing gitleaks secret scan.
-
-### Changed
-- Public wording on the local trust model's TUF-evolution is now locked to the reviewed sentence across docs/README/site copy.
-
-### Notes
-- Everything above remains **local-first, no telemetry, no hosted backend** -- nothing in this release changes that.
-
-## [0.5.0] - 2026-07-01 -- Route engine + PR-GPS (Protocol v1)
-
-### Added
-- **`.knosky` protocol foundation:** versioned config (`.knosky/config.yml`), `route.json` and `intent-manifest` schemas (`knosky_protocol: "1.0"`).
-- **Route engine (`kc_route`):** point at a destination -- a file, a folder, an import chain, a "district" (category) -- and get a ranked, advisory route through the repo with waypoints, alternates, confidence, and caveats. Structural only: file/folder/imports/dependency-chain, never semantic/code-meaning.
-- **`kc_bundle`:** builds a shareable intent-manifest (paths + sha256 + edges) with a fail-closed secret scan, for agents that need to share a scoped, verifiable file set.
-- **PR-GPS:** `knosky ci` generates an advisory navigation report for a pull request's changed files. A new GitHub Action posts/updates it as a single PR comment automatically -- advisory only, never blocks or gates a build.
-
-### Security
-- Independent adversarial pass ahead of this release: fixed a symlink-escape read and an unreadable-file fail-open in the bundle engine, a git-ref option-injection in the CI report generator, plus two additional issues found during the pass. See the repo's PR history for detail.
-
-### Notes
-- Everything above is **advisory-only, metadata-only, local, no telemetry** -- KnoSky reads structure, never uploads your code, and nothing here blocks or gates a build.
-
-## [0.4.1] - 2026-06-29 — Security review fixes
-
-### Security
-- **The fail-closed secret scan now actually fails closed.** It previously ran *after* scrubbing, so a secret in a title/heading/summary was silently redacted instead of blocking the build. It now scans the **un-scrubbed** projections before serialization and blocks (the post-scrub residual is kept as a defense-in-depth gap detector). A secret in a heading now stops the build.
-- **Embedded mode is fail-closed.** The postMessage bridge now requires a non-empty `window.__KC_ALLOWED_ORIGINS` allowlist (the bridge is disabled if it is empty), only accepts messages from the embedding parent frame, and never broadcasts readiness to `"*"`.
-
-### Added
-- `test/security-fixtures.mjs` — pure-Node regression tests (secret block, ignore rules, XSS escaping, embed fail-closed). Run `node test/security-fixtures.mjs`.
-- `.github/workflows/ci.yml` — runs the fixtures + `npm audit` on every PR.
-- Root `package-lock.json` for reproducible `npx` / `npm ci` installs.
-
-### Changed
-- README: removed a "zero data risk" line that contradicted PRIVACY.md.
-
-## [0.4.0] - 2026-06-29 — File Connections + churn (code-intel)
-
-### Added
-- **File Connections:** import/dependency edges drawn as roads between buildings — select a file to see what it imports and what imports it. Per-language import scan over a bounded prefix; specifiers are resolved to repo files and then discarded (file-to-file edges only).
-- **Churn heat:** recently-changed files glow on the map, from `git log` (per-file commit count only).
-- **MCP `kc_related`:** ask your assistant "what connects to this file?" — out-edges, in-edges, and churn, with citations.
-- Flags: `--no-graph`, `--no-churn` to omit either signal.
-
-### Notes
-- Strictly **file-level metadata** (decision D-155): no symbol names, no ASTs, no code bodies, no commit messages/diffs. KnoSky maps how files connect; it does not analyze your code.
-
-## [0.3.0] - 2026-06-29 — One-command launcher (npx)
-
-### Added
-- `npx knosky [path]` one-command launcher: indexes the folder, builds and opens the city, prints the MCP config (Claude Code / Claude Desktop / Cursor / VS Code) and suggested first prompts, then starts the local MCP server. Flags: `--no-open`, `--no-serve`. Reuses the verified indexer/renderer/MCP and inherits fail-closed `--share-safe` safety.
-- Root `package.json` with a `knosky` bin and a `files` allowlist for publishing.
-
-## [0.2.0] - 2026-06-29 — Security hardening + safe-share
-
-### Security
-- **Generated artifacts hardened against injection.** City data is embedded as inert JSON (`<script type="application/json">`) and the builder escapes `<` and U+2028/U+2029, so a repo containing `</script>` can no longer execute code in a generated city.
-- **Untrusted names escaped.** District/category names, file titles, and kinds render through HTML escaping; colors are validated. A folder named `<img onerror=...>` renders as harmless text, not a live element.
-- **Fail-closed secret scanning.** Expanded patterns (GitHub, OpenAI, Stripe, Google, Slack, GitLab, npm, JWT, SSH, AWS, PEM). The build now **fails closed** if a secret-like value is detected (override with `--allow-leaks`).
-- **postMessage bridge gated.** Disabled in the standalone build; only active in embedded mode with an origin allowlist.
-
-### Added
-- `--share-safe` — strips the absolute root path (basename only) and prints a safety report.
-- `--include-absolute-root` — opt back in to the full local path for private diagnostics.
-- `SECURITY.md`, `PRIVACY.md`, `LIMITATIONS.md` — disclosure path + trust docs.
-
-### Changed
-- **Privacy default:** the generated index stores the folder **basename**, not the absolute path.
-- **Ignore accuracy:** inside a git repo, git's own ignore rules are applied (`git check-ignore`); the conservative parser remains the fallback for non-git folders.
-- **MCP input caps:** `kc_search` bounds query length and result count; ids are length-capped — avoids token burn and runaway output.
-- Committed a lockfile for reproducible MCP installs.
-
-## [0.1.0] - 2026-06-27 — Initial public release
-- Local-first repo/folder → explorable isometric city (Kenney CC0 art).
-- Local stdio MCP: `kc_search`, `kc_get_node`, `kc_list_categories`, `kc_get_provenance`.
-- Single-file, self-contained city HTML. FSL-1.1-MIT license.
+# Changelog
+
+All notable changes to KnoSky. Versions are git-tagged on this repo.
+
+## [Unreleased] — F0.5 OS-level network lockdown for the evaluator process
+
+### Security
+- **F0.5 network lockdown (SAT-549):** the evaluator process can now be placed in an OS-level
+  network sandbox that structurally denies non-loopback network syscalls at the kernel level —
+  defense-in-depth beyond the existing static no-egress import lint (F1 Fix 7, which stays as a
+  cheap first-line check).
+  - **Linux:** unprivileged user+network namespace via `unshare --user --net`.  The kernel-level
+    routing table inside the namespace has no external routes; all TCP/UDP attempts to non-loopback
+    addresses return ENETUNREACH immediately.  Unix-domain sockets (used by F0.4/SO_PEERCRED IPC)
+    are unaffected.
+  - **macOS:** `sandbox-exec(1)` with a minimal SBPL profile that denies outbound network and
+    permits loopback and Unix sockets.  Full App Sandbox requires packaging-time entitlements;
+    `knosky doctor` reports availability.
+  - **Windows:** WFP/AppContainer is a packaging-time concern; `knosky doctor` detects whether
+    the current process is running inside an AppContainer and reports plainly if not.
+  - **F0.4-survives-sandbox conformance:** SO_PEERCRED (Unix-domain socket IPC) is verified to
+    work correctly inside the Linux net namespace — no carve-out needed, no general sandbox
+    loosening required.
+- **`knosky doctor` subcommand:** new `knosky doctor` command surfaces the F0.5 sandbox status
+  (active / available-but-not-running / unsupported-with-reason) so operators can confirm the
+  lockdown is in effect rather than silently proceeding without it.
+
+### Notes
+- `core/net-lockdown.mjs` exports `probeNetworkLockdownSupport()`, `wrapArgsForLockdown()`, and
+  `doctorLines()` — pure stdlib, no new dependencies.
+- The static no-egress import lint (F1 Fix 7) is unchanged; F0.5 is an additional OS-level layer,
+  not a replacement.
+
+## [0.6.3] - 2026-07-04 -- Zoomed-out view redesigned as a clean city silhouette
+
+### Changed
+- **Default zoomed-out view:** replaced the per-district badge overview added in 0.6.1/0.6.2 with a single flat-green city silhouette -- closer to viewing a map/globe from far out than a dashboard of counters. District and building detail now appears once you zoom in or select a district, which is also when the underlying ground/building geometry renders.
+
+### Fixed
+- **Missing island surface:** the isometric island's top face was never filled at any zoom level -- only its two side walls and an edge outline were drawn. This is also the root cause of earlier reports that the zoomed-out view showed "just an outline."
+
+### Notes
+- No change to indexing, protocol, or trust-root behavior.
+
+## [0.6.2] - 2026-07-03 -- District badges and building markers were rendering at sub-pixel size
+
+### Fixed
+- **Invisible zoomed-out markers:** district badges (added in 0.6.1) and individual building dots at the next zoom level in were both sized in world units that get scaled down by the camera's own zoom factor. At the very low zoom values those two tiers are designed for, this shrank every badge and dot to about a pixel or less -- present in the data, invisible on screen. Both were made a constant, readable size on screen regardless of zoom (superseded by the 0.6.3 redesign above for the district-badge tier).
+
+### Notes
+- No change to indexing, protocol, or trust-root behavior.
+
+## [0.6.1] - 2026-07-03 -- District overview badges were never rendering
+
+### Fixed
+- **Zoomed-out district badges:** the renderer computed a per-district "cluster badge" overview for the fully-zoomed-out view, but the function that populates it was never actually called, so zooming all the way out showed nothing but the map's outline. Badges populated correctly after this fix (superseded by the 0.6.3 redesign above).
+
+### Notes
+- No change to indexing, protocol, or trust-root behavior.
+
+## [0.6.0] - 2026-07-02 -- Trust-root hardening, rendering at scale, adversarial red-team suite
+
+### Added
+- **Rendering engine at scale:** level-of-detail rendering, clustering, virtualization, and streaming for large single-repo graphs; a cross-repo graph concept and rendering for multi-repo sets.
+- **Adversarial red-team suite:** a full pass across four categories -- indexer/artifact safety, local trust root, rendering engine, protocol/schema -- now wired into CI as a required check on every PR, and into the release workflow as a hard gate before any `npm publish`. Findings, fixes, and accepted limitations are published in [RED-TEAM.md](RED-TEAM.md).
+- **Conditional publish gate:** the release workflow now runs the complete test suite (including the full red-team suite) before publishing; any failure blocks the release rather than proceeding silently.
+- **Real-world validation:** indexing and rendering validated at scale against a large real monorepo and a real 4-repo linked set with genuine cross-repo dependencies, plus an adversarial case with deliberately stale/conflicting policy data.
+- **Measurement infrastructure (advisory, offline, no telemetry):** a naive-vs-KnoSky-guided agent comparison protocol, and a harness to run the same benchmark simultaneously across multiple model families for independent comparison.
+- **Protocol Adoption Kit:** a start-here doc, a machine-readable protocol spec with schemas, a model-agnostic onboarding contract, and GitHub Action packaging reusing the PR-GPS pattern.
+- Comparison page and additional launch documentation under `wiki/`.
+
+### Security
+- **Trust-root hardening (Hardening Addendum 2):** full key rotation/revocation lifecycle. Two quorum-math edge cases are identified, fixed where fixable, and explicitly documented rather than hidden: the N=2 degenerate case (mathematically unavoidable at N=2 -- maintain N>=3 for real threshold protection) and the M=0 sole-remaining-key self-revocation case (an intentional design choice -- see SECURITY.md). The ledger high-water-mark guard is now correctly consumed by the freshness-attestation check it was built to protect.
+- **CI hardening:** a new AI-assisted security review runs on every pull request alongside the existing gitleaks secret scan.
+
+### Changed
+- Public wording on the local trust model's TUF-evolution is now locked to the reviewed sentence across docs/README/site copy.
+
+### Notes
+- Everything above remains **local-first, no telemetry, no hosted backend** -- nothing in this release changes that.
+
+## [0.5.0] - 2026-07-01 -- Route engine + PR-GPS (Protocol v1)
+
+### Added
+- **`.knosky` protocol foundation:** versioned config (`.knosky/config.yml`), `route.json` and `intent-manifest` schemas (`knosky_protocol: "1.0"`).
+- **Route engine (`kc_route`):** point at a destination -- a file, a folder, an import chain, a "district" (category) -- and get a ranked, advisory route through the repo with waypoints, alternates, confidence, and caveats. Structural only: file/folder/imports/dependency-chain, never semantic/code-meaning.
+- **`kc_bundle`:** builds a shareable intent-manifest (paths + sha256 + edges) with a fail-closed secret scan, for agents that need to share a scoped, verifiable file set.
+- **PR-GPS:** `knosky ci` generates an advisory navigation report for a pull request's changed files. A new GitHub Action posts/updates it as a single PR comment automatically -- advisory only, never blocks or gates a build.
+
+### Security
+- Independent adversarial pass ahead of this release: fixed a symlink-escape read and an unreadable-file fail-open in the bundle engine, a git-ref option-injection in the CI report generator, plus two additional issues found during the pass. See the repo's PR history for detail.
+
+### Notes
+- Everything above is **advisory-only, metadata-only, local, no telemetry** -- KnoSky reads structure, never uploads your code, and nothing here blocks or gates a build.
+
+## [0.4.1] - 2026-06-29 — Security review fixes
+
+### Security
+- **The fail-closed secret scan now actually fails closed.** It previously ran *after* scrubbing, so a secret in a title/heading/summary was silently redacted instead of blocking the build. It now scans the **un-scrubbed** projections before serialization and blocks (the post-scrub residual is kept as a defense-in-depth gap detector). A secret in a heading now stops the build.
+- **Embedded mode is fail-closed.** The postMessage bridge now requires a non-empty `window.__KC_ALLOWED_ORIGINS` allowlist (the bridge is disabled if it is empty), only accepts messages from the embedding parent frame, and never broadcasts readiness to `"*"`.
+
+### Added
+- `test/security-fixtures.mjs` — pure-Node regression tests (secret block, ignore rules, XSS escaping, embed fail-closed). Run `node test/security-fixtures.mjs`.
+- `.github/workflows/ci.yml` — runs the fixtures + `npm audit` on every PR.
+- Root `package-lock.json` for reproducible `npx` / `npm ci` installs.
+
+### Changed
+- README: removed a "zero data risk" line that contradicted PRIVACY.md.
+
+## [0.4.0] - 2026-06-29 — File Connections + churn (code-intel)
+
+### Added
+- **File Connections:** import/dependency edges drawn as roads between buildings — select a file to see what it imports and what imports it. Per-language import scan over a bounded prefix; specifiers are resolved to repo files and then discarded (file-to-file edges only).
+- **Churn heat:** recently-changed files glow on the map, from `git log` (per-file commit count only).
+- **MCP `kc_related`:** ask your assistant "what connects to this file?" — out-edges, in-edges, and churn, with citations.
+- Flags: `--no-graph`, `--no-churn` to omit either signal.
+
+### Notes
+- Strictly **file-level metadata** (decision D-155): no symbol names, no ASTs, no code bodies, no commit messages/diffs. KnoSky maps how files connect; it does not analyze your code.
+
+## [0.3.0] - 2026-06-29 — One-command launcher (npx)
+
+### Added
+- `npx knosky [path]` one-command launcher: indexes the folder, builds and opens the city, prints the MCP config (Claude Code / Claude Desktop / Cursor / VS Code) and suggested first prompts, then starts the local MCP server. Flags: `--no-open`, `--no-serve`. Reuses the verified indexer/renderer/MCP and inherits fail-closed `--share-safe` safety.
+- Root `package.json` with a `knosky` bin and a `files` allowlist for publishing.
+
+## [0.2.0] - 2026-06-29 — Security hardening + safe-share
+
+### Security
+- **Generated artifacts hardened against injection.** City data is embedded as inert JSON (`<script type="application/json">`) and the builder escapes `<` and U+2028/U+2029, so a repo containing `</script>` can no longer execute code in a generated city.
+- **Untrusted names escaped.** District/category names, file titles, and kinds render through HTML escaping; colors are validated. A folder named `<img onerror=...>` renders as harmless text, not a live element.
+- **Fail-closed secret scanning.** Expanded patterns (GitHub, OpenAI, Stripe, Google, Slack, GitLab, npm, JWT, SSH, AWS, PEM). The build now **fails closed** if a secret-like value is detected (override with `--allow-leaks`).
+- **postMessage bridge gated.** Disabled in the standalone build; only active in embedded mode with an origin allowlist.
+
+### Added
+- `--share-safe` — strips the absolute root path (basename only) and prints a safety report.
+- `--include-absolute-root` — opt back in to the full local path for private diagnostics.
+- `SECURITY.md`, `PRIVACY.md`, `LIMITATIONS.md` — disclosure path + trust docs.
+
+### Changed
+- **Privacy default:** the generated index stores the folder **basename**, not the absolute path.
+- **Ignore accuracy:** inside a git repo, git's own ignore rules are applied (`git check-ignore`); the conservative parser remains the fallback for non-git folders.
+- **MCP input caps:** `kc_search` bounds query length and result count; ids are length-capped — avoids token burn and runaway output.
+- Committed a lockfile for reproducible MCP installs.
+
+## [0.1.0] - 2026-06-27 — Initial public release
+- Local-first repo/folder → explorable isometric city (Kenney CC0 art).
+- Local stdio MCP: `kc_search`, `kc_get_node`, `kc_list_categories`, `kc_get_provenance`.
+- Single-file, self-contained city HTML. FSL-1.1-MIT license.

package/CREDITS.md

@@ -1,14 +1,14 @@
-# Credits
-
-## Artwork
-City sprites (buildings, city details, landscape tiles, vehicles) are by **Kenney** — <https://kenney.nl>.
-Licensed **CC0 1.0 Universal (public domain)**: <https://creativecommons.org/publicdomain/zero/1.0/>.
-No rights reserved; attribution appreciated but not required. The original texture atlases ship in
-`renderer/art/kenney/`.
-
-## Software
-KnoSky is released under the Functional Source License (FSL-1.1-MIT) — see [LICENSE.md](./LICENSE.md).
-
-Dependencies:
-- [`@modelcontextprotocol/sdk`](https://github.com/modelcontextprotocol/typescript-sdk) (MIT) — local MCP server.
-- [`zod`](https://github.com/colinhacks/zod) (MIT) — schema validation.
+# Credits
+
+## Artwork
+City sprites (buildings, city details, landscape tiles, vehicles) are by **Kenney** — <https://kenney.nl>.
+Licensed **CC0 1.0 Universal (public domain)**: <https://creativecommons.org/publicdomain/zero/1.0/>.
+No rights reserved; attribution appreciated but not required. The original texture atlases ship in
+`renderer/art/kenney/`.
+
+## Software
+KnoSky is released under the Functional Source License (FSL-1.1-MIT) — see [LICENSE.md](./LICENSE.md).
+
+Dependencies:
+- [`@modelcontextprotocol/sdk`](https://github.com/modelcontextprotocol/typescript-sdk) (MIT) — local MCP server.
+- [`zod`](https://github.com/colinhacks/zod) (MIT) — schema validation.

package/LICENSE.md

@@ -1,76 +1,76 @@
-# Functional Source License, Version 1.1, MIT Future License
-
-## Abbreviation
-
-FSL-1.1-MIT
-
-## Notice
-
-Copyright 2026 Paul Poulose / Sathia
-
-## Terms and Conditions
-
-### Licensor ("We")
-
-The party offering the Software under these Terms and Conditions.
-
-### The Software
-
-The "Software" is each version of the software that we make available under these Terms and Conditions, as indicated by our inclusion of these Terms and Conditions with the Software.
-
-### License Grant
-
-Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below.
-
-### Permitted Purpose
-
-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that:
-
-1. substitutes for the Software;
-
-2. substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or
-
-3. offers the same or substantially similar functionality as the Software.
-
-Permitted Purposes specifically include using the Software:
-
-1. for your internal use and access;
-
-2. for non-commercial education;
-
-3. for non-commercial research; and
-
-4. in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions.
-
-### Patents
-
-To the extent your use for a Permitted Purpose would necessarily infringe our patents, the license grant above includes a license under our patents. If you make a claim against any party that the Software infringes or contributes to the infringement of any patent, then your patent license to the Software ends immediately.
-
-### Redistribution
-
-The Terms and Conditions apply to all copies, modifications and derivatives of the Software. If you redistribute any copies, modifications or derivatives of the Software, you must include a copy of or a link to these Terms and Conditions and not remove any copyright notices provided in or with the Software.
-
-### Disclaimer
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT.
-
-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
-
-### Trademarks
-
-Except for displaying the License Details and identifying us as the origin of the Software, you have no right under these Terms and Conditions to use our trademarks, trade names, service marks or product names.
-
-## Grant of Future License
-
-We hereby irrevocably grant you an additional license to use the Software under the MIT License that is effective on the second anniversary of the date we make the Software available. On or after that date, you may use the Software under the MIT License, in which case the following will apply:
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of the Software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
----
-
-> Note (not part of the license): "KnoSky" and "Sathia" are trademarks of the Licensor. FSL gives
-> free use without allowing a competing product; it converts to MIT two years after each version's release.
+# Functional Source License, Version 1.1, MIT Future License
+
+## Abbreviation
+
+FSL-1.1-MIT
+
+## Notice
+
+Copyright 2026 Paul Poulose / Sathia
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under these Terms and Conditions, as indicated by our inclusion of these Terms and Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our patents, the license grant above includes a license under our patents. If you make a claim against any party that the Software infringes or contributes to the infringement of any patent, then your patent license to the Software ends immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of the Software. If you redistribute any copies, modifications or derivatives of the Software, you must include a copy of or a link to these Terms and Conditions and not remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of the Software, you have no right under these Terms and Conditions to use our trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under the MIT License that is effective on the second anniversary of the date we make the Software available. On or after that date, you may use the Software under the MIT License, in which case the following will apply:
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of the Software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
+> Note (not part of the license): "KnoSky" and "Sathia" are trademarks of the Licensor. FSL gives
+> free use without allowing a competing product; it converts to MIT two years after each version's release.

package/LIMITATIONS.md

@@ -1,23 +1,33 @@
-# Known limitations
-
-KnoSky is a **map and citation layer**, not a code-intelligence engine. Being clear about the boundary keeps expectations honest.
-
-## What KnoSky is good at
-
-- Orienting you in a repo or docs folder fast: where things live, how areas connect.
-- Giving you (and your AI assistant, via the local MCP) **cited pointers** back to the real source.
-- A private, always-fresh, $0 index that runs entirely on your machine.
-
-## What KnoSky is not (yet)
-
-- **Not deep code intelligence.** It does not parse call graphs, type information, runtime dependencies, or semantic architecture. It indexes pointers and light projections, not file bodies.
-- **Not a full-text / code-RAG search.** It will not answer questions over the *contents* of your files. For deep code Q&A, your AI assistant should read the source it cites (that's what the MCP citations are for) or use a dedicated code-search tool.
-- **Not a cloud service.** No sync, no multi-user, no hosted backend.
-
-## Practical notes
-
-- **Ignore matching:** inside a git repo, git's own ignore rules are applied; outside git, a conservative `.gitignore`/`.kcignore` parser is used and may differ from git in edge cases.
-- **Large repos:** indexing is capped (default 6000 files, `--max`) to stay fast; very large monorepos may need `--max` raised or extra `.kcignore` entries.
-- **Categories:** the default categorizer uses top-level folder names. AI-suggested categories are opt-in and metadata-only.
-
-See also: [README.md](README.md), [PRIVACY.md](PRIVACY.md), [SECURITY.md](SECURITY.md).
+# Known limitations
+
+KnoSky is a **map and citation layer**, not a code-intelligence engine. Being clear about the boundary keeps expectations honest.
+
+## What KnoSky is good at
+
+- Orienting you in a repo or docs folder fast: where things live, how areas connect.
+- Giving you (and your AI assistant, via the local MCP) **cited pointers** back to the real source.
+- A private, always-fresh, $0 index that runs entirely on your machine.
+
+## What KnoSky is not (yet)
+
+- **Not deep code intelligence.** It does not parse call graphs, type information, runtime dependencies, or semantic architecture. It indexes pointers and light projections, not file bodies.
+- **Not a full-text / code-RAG search.** It will not answer questions over the *contents* of your files. For deep code Q&A, your AI assistant should read the source it cites (that's what the MCP citations are for) or use a dedicated code-search tool.
+- **Not a cloud service.** No sync, no multi-user, no hosted backend.
+
+## Practical notes
+
+- **Ignore matching:** inside a git repo, git's own ignore rules are applied; outside git, a conservative `.gitignore`/`.kcignore` parser is used and may differ from git in edge cases.
+- **Large repos:** indexing is capped (default 6000 files, `--max`) to stay fast; very large monorepos may need `--max` raised or extra `.kcignore` entries.
+- **Categories:** the default categorizer uses top-level folder names. AI-suggested categories are opt-in and metadata-only.
+
+## Network lockdown scope (F0.5)
+
+The OS-level network sandbox (`core/net-lockdown.mjs`, wraps the MCP server / evaluator process) is **network-only by design**, not a general filesystem or process jail:
+
+- On macOS, the `sandbox-exec` profile allows filesystem and process operations (the evaluator needs full read access to your indexed files) and denies only non-loopback outbound/inbound network -- confirmed via PR #60 review (2026-07-05).
+- On Windows, there is currently no runtime AppContainer detection -- `knosky doctor` always reports it as inactive. This is safe (nothing in the code claims runtime enforcement on Windows either way: `supported` is always `false`), but real Windows network isolation requires packaging-time AppContainer/WFP configuration, which this tool does not automate.
+- On Linux, `unshare --user --net` provides a real kernel-enforced network namespace.
+
+If you depend on this for anything beyond defense-in-depth / `doctor` visibility, treat macOS and Windows as advisory only; Linux's `unshare` path is the one with an actual kernel-enforced guarantee.
+
+See also: [README.md](README.md), [PRIVACY.md](PRIVACY.md), [SECURITY.md](SECURITY.md).

package/PRIVACY.md

@@ -1,30 +1,30 @@
-# Privacy
-
-KnoSky is **local-first**. It runs on your machine, reads your folder, and writes files on your machine. There is no KnoSky account, no server, and no telemetry. Your source code is never uploaded by KnoSky.
-
-## What KnoSky reads
-
-To build the map, the indexer reads file and folder names and the **first ~4 KB** of text files (to pull a title, a few headings, and a one-line excerpt). It does **not** copy full file bodies.
-
-## What ends up in a generated city
-
-A generated `city-data.json` / city HTML contains **pointers and light projections**, not your code:
-
-- file paths (relative), folder/category names
-- titles, a handful of headings, and a short (<=200 char) excerpt per file
-- tags (file extensions), simple link relationships, and a source revision
-
-It does **not** contain full file contents.
-
-## Defaults that protect you
-
-- The absolute root path is **stripped to its basename** by default (use `--include-absolute-root` only for private, local diagnostics).
-- Text projections run through a **secret/PII scrubber**, and the build **fails closed** if a secret-like value is detected (override only with `--allow-leaks`).
-- `--share-safe` prints a safety report (files scanned/skipped, secrets found, risk level) before you share anything.
-- `.gitignore` and a `.kcignore` are honored; inside a git repo, git's own ignore rules are applied.
-
-## What we don't promise
-
-We do **not** claim "zero data risk." A generated city is like a directory listing with short snippets. Treat it accordingly: **review a city file (or build with `--share-safe`) before sharing it**, and open city files you did not generate the same way you'd open any untrusted HTML.
-
-See also: [SECURITY.md](SECURITY.md), [LIMITATIONS.md](LIMITATIONS.md).
+# Privacy
+
+KnoSky is **local-first**. It runs on your machine, reads your folder, and writes files on your machine. There is no KnoSky account, no server, and no telemetry. Your source code is never uploaded by KnoSky.
+
+## What KnoSky reads
+
+To build the map, the indexer reads file and folder names and the **first ~4 KB** of text files (to pull a title, a few headings, and a one-line excerpt). It does **not** copy full file bodies.
+
+## What ends up in a generated city
+
+A generated `city-data.json` / city HTML contains **pointers and light projections**, not your code:
+
+- file paths (relative), folder/category names
+- titles, a handful of headings, and a short (<=200 char) excerpt per file
+- tags (file extensions), simple link relationships, and a source revision
+
+It does **not** contain full file contents.
+
+## Defaults that protect you
+
+- The absolute root path is **stripped to its basename** by default (use `--include-absolute-root` only for private, local diagnostics).
+- Text projections run through a **secret/PII scrubber**, and the build **fails closed** if a secret-like value is detected (override only with `--allow-leaks`).
+- `--share-safe` prints a safety report (files scanned/skipped, secrets found, risk level) before you share anything.
+- `.gitignore` and a `.kcignore` are honored; inside a git repo, git's own ignore rules are applied.
+
+## What we don't promise
+
+We do **not** claim "zero data risk." A generated city is like a directory listing with short snippets. Treat it accordingly: **review a city file (or build with `--share-safe`) before sharing it**, and open city files you did not generate the same way you'd open any untrusted HTML.
+
+See also: [SECURITY.md](SECURITY.md), [LIMITATIONS.md](LIMITATIONS.md).