mneme-ai 2.117.0 → 2.118.0

package/dist/commands/egress.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `mneme egress` (v2.118.0) — SOVEREIGN EGRESS GUARD. Scan an outbound AI
+ * payload at the boundary: pattern-redact known secrets, trip on honeytoken
+ * canaries (exfiltration), catch registered secrets via a Bloom filter — and
+ * emit a SIGNED certificate a risk officer can audit offline. "Our code/secrets
+ * never leak to the model — with proof."
+ *
+ *   mycmd-context | mneme egress scan                 # scan stdin
+ *   mneme egress scan --file out.txt --json           # structured + signed
+ *   mneme egress seed-canary                           # plant a tripwire token
+ *
+ * Zero config: canaries from .mneme/egress/canaries.txt, secret fingerprints
+ * from .mneme/egress/secrets.txt (gitignored; never stored in the cert).
+ */
+import type { Command } from "commander";
+export declare function registerEgressCommands(program: Command): void;
+//# sourceMappingURL=egress.d.ts.map

package/dist/commands/egress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../../src/commands/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4BzC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+C7D"}

package/dist/commands/egress.js

@@ -0,0 +1,133 @@
+/**
+ * `mneme egress` (v2.118.0) — SOVEREIGN EGRESS GUARD. Scan an outbound AI
+ * payload at the boundary: pattern-redact known secrets, trip on honeytoken
+ * canaries (exfiltration), catch registered secrets via a Bloom filter — and
+ * emit a SIGNED certificate a risk officer can audit offline. "Our code/secrets
+ * never leak to the model — with proof."
+ *
+ *   mycmd-context | mneme egress scan                 # scan stdin
+ *   mneme egress scan --file out.txt --json           # structured + signed
+ *   mneme egress seed-canary                           # plant a tripwire token
+ *
+ * Zero config: canaries from .mneme/egress/canaries.txt, secret fingerprints
+ * from .mneme/egress/secrets.txt (gitignored; never stored in the cert).
+ */
+import { existsSync, readFileSync, mkdirSync, appendFileSync, writeFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+function writeJson(p) { process.stdout.write(JSON.stringify(p, null, 2) + "\n"); }
+function writeText(l) { process.stdout.write(l + "\n"); }
+async function core() {
+    try {
+        const c = (await import("@mneme-ai/core"));
+        if (c.egress)
+            return c;
+    }
+    catch { /* */ }
+    return null;
+}
+const CANARY_FILE = ".mneme/egress/canaries.txt";
+const SECRETS_FILE = ".mneme/egress/secrets.txt";
+function readLines(p) { try {
+    return existsSync(p) ? readFileSync(p, "utf8").split(/\r?\n/).map((l) => l.trim()).filter(Boolean) : [];
+}
+catch {
+    return [];
+} }
+function readStdin() {
+    return new Promise((resolve) => {
+        if (process.stdin.isTTY)
+            return resolve("");
+        let d = "";
+        let done = false;
+        const fin = () => { if (!done) {
+            done = true;
+            resolve(d);
+        } };
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (c) => { d += c; if (d.length > 8_000_000)
+            fin(); });
+        process.stdin.on("end", fin);
+        process.stdin.on("error", fin);
+        setTimeout(fin, 4000);
+    });
+}
+export function registerEgressCommands(program) {
+    const eg = program.command("egress").description("🛡 SOVEREIGN EGRESS GUARD — scan outbound AI payloads at the boundary (pattern-redact secrets + honeytoken tripwire + Bloom secret-membership), emit a SIGNED certificate. 'Code/secrets never leak — with proof.'");
+    eg.command("scan")
+        .description("Scan an outbound payload (stdin / --file / --text). Verdict ALLOW | REDACT | BLOCK + signed cert. Exit 2 on BLOCK (CI-gate).")
+        .option("--text <t>", "payload inline (else stdin).")
+        .option("--file <p>", "read payload from a file.")
+        .option("--json", "JSON output (redacted payload + signed cert).")
+        .action(async (opts) => {
+        const m = await core();
+        if (!m) {
+            writeText("✗ core unavailable");
+            process.exitCode = 1;
+            return;
+        }
+        const cwd = process.cwd();
+        let payload = typeof opts.text === "string" ? opts.text : "";
+        if (!payload && opts.file) {
+            try {
+                if (existsSync(opts.file))
+                    payload = readFileSync(opts.file, "utf8");
+            }
+            catch { /* */ }
+        }
+        if (!payload)
+            payload = await readStdin();
+        const canaries = readLines(join(cwd, CANARY_FILE));
+        const secrets = readLines(join(cwd, SECRETS_FILE));
+        const secretBloom = secrets.length > 0 ? m.egress.buildSecretBloom(secrets, { m: 1 << 16, k: 5 }) : undefined;
+        const r = m.egress.scanEgress({ payload, canaries, secretBloom });
+        let receipt = null;
+        try {
+            receipt = m.notary?.issueReceipt(cwd, { kind: "claim-verdict", subject: `egress:${r.verdict}`, payload: { verdict: r.verdict, contentHash: r.contentHash, secretsRedacted: r.secretsRedacted, canariesTripped: r.canariesTripped.length, bloomHits: r.bloomHits, residualRisk: r.residualRisk }, includePayload: true });
+        }
+        catch { /* */ }
+        if (opts.json) {
+            writeJson({ verdict: r.verdict, secretsRedacted: r.secretsRedacted, canariesTripped: r.canariesTripped.length, bloomHits: r.bloomHits, residualRisk: r.residualRisk, findings: r.findings, contentHash: r.contentHash, redactedPayload: r.redactedPayload, signed: receipt, note: r.note });
+        }
+        else {
+            const icon = r.verdict === "BLOCK" ? "🛑" : r.verdict === "REDACT" ? "✂️" : "✓";
+            writeText(`${icon} EGRESS ${r.verdict} — ${r.secretsRedacted} secret(s) redacted · ${r.canariesTripped.length} canary tripwire(s) · ${r.bloomHits} registered-secret hit(s) · residual risk ${r.residualRisk}`);
+            for (const f of r.findings)
+                writeText(`   • ${f.kind}: ${f.count}`);
+            if (r.verdict === "BLOCK")
+                writeText(`   🛑 HONEYTOKEN TRIPPED — an org canary appeared in an outbound payload. This is an exfiltration signal; DO NOT send.`);
+            if (receipt)
+                writeText(`   ✓ signed egress certificate (binds payload hash ${r.contentHash.slice(0, 12)}… — verify offline with the NOTARY public key)`);
+        }
+        if (r.verdict === "BLOCK")
+            process.exitCode = 2;
+    });
+    eg.command("seed-canary")
+        .description("Plant a deterministic honeytoken canary into .mneme/egress/canaries.txt — if it ever appears in an outbound payload, the guard BLOCKs (exfiltration tripwire).")
+        .option("--label <l>", "human label for the canary", "default")
+        .action(async (opts) => {
+        const cwd = process.cwd();
+        const token = `mneme-canary-${(opts.label ?? "default").replace(/[^a-z0-9_-]/gi, "")}-${randomBytes(6).toString("hex")}`;
+        try {
+            const p = join(cwd, CANARY_FILE);
+            if (!existsSync(dirname(p)))
+                mkdirSync(dirname(p), { recursive: true });
+            appendFileSync(p, token + "\n");
+            // best-effort: keep canaries out of git
+            try {
+                const gi = join(cwd, ".gitignore");
+                const cur = existsSync(gi) ? readFileSync(gi, "utf8") : "";
+                if (!cur.includes(".mneme/egress/"))
+                    writeFileSync(gi, cur + (cur.endsWith("\n") || cur === "" ? "" : "\n") + ".mneme/egress/\n");
+            }
+            catch { /* */ }
+            writeText(`🪤 canary planted: ${token}`);
+            writeText(`   Place it in a decoy config/secret. If it ever crosses egress, the guard BLOCKs + signs an alert.`);
+        }
+        catch (e) {
+            writeText(`✗ ${e.message}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=egress.js.map

package/dist/commands/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/commands/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,SAAS,SAAS,CAAC,CAAU,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACjG,SAAS,SAAS,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAMvE,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAqB,CAAC;QAAC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,YAAY,GAAG,2BAA2B,CAAC;AACjD,SAAS,SAAS,CAAC,CAAS,IAAc,IAAI,CAAC;IAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC;AAAC,CAAC,CAAC,CAAC;AACjL,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,KAAK,CAAC;QAAC,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,SAAS;YAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,oNAAoN,CAAC,CAAC;IAEvQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8HAA8H,CAAC;SAC3I,MAAM,CAAC,YAAY,EAAE,8BAA8B,CAAC;SACpD,MAAM,CAAC,YAAY,EAAE,2BAA2B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,+CAA+C,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,IAAsD,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAC5H,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,MAAM,SAAS,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACjV,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;aAC1S,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAChF,SAAS,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,eAAe,yBAAyB,CAAC,CAAC,eAAe,CAAC,MAAM,yBAAyB,CAAC,CAAC,SAAS,6CAA6C,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;YAChN,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;gBAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS,CAAC,wHAAwH,CAAC,CAAC;YAC/J,IAAI,OAAO;gBAAE,SAAS,CAAC,sDAAsD,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gDAAgD,CAAC,CAAC;QAC3J,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,gKAAgK,CAAC;SAC7K,MAAM,CAAC,aAAa,EAAE,4BAA4B,EAAE,SAAS,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzH,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,cAAc,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;YAChC,wCAAwC;YACxC,IAAI,CAAC;gBAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAAC,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBAAE,aAAa,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1P,SAAS,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;YACzC,SAAS,CAAC,qGAAqG,CAAC,CAAC;QACnH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,SAAS,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkJA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAogNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAmJA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqgNvD"}

package/dist/index.js

@@ -79,6 +79,7 @@ import { registerLoopguardCommands } from "./commands/loopguard.js";
 import { registerDistillCommands } from "./commands/distill.js";
 import { registerSavingsCommands } from "./commands/savings.js";
 import { registerMapCommands } from "./commands/map.js";
+import { registerEgressCommands } from "./commands/egress.js";
 import { registerTrustCommands } from "./commands/trust.js";
 import { registerNuclearCommands } from "./commands/nuclear-cli.js";
 import { registerOvernightCommand } from "./commands/overnight.js";
@@ -4703,6 +4704,7 @@ export async function run(argv) {
     registerDistillCommands(program);
     registerSavingsCommands(program);
     registerMapCommands(program);
+    registerEgressCommands(program);
     // ─── Trust calibrator (v1.31.0) -- per-subsystem precision/recall/band
     registerTrustCommands(program);
     // ─── Wisdom reactor (v1.33.0) -- five nuclear-physics formulas as Mneme metrics