superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/cli/compress_cmd.py

@@ -118,8 +118,13 @@ def cmd_compress_prose(args: Namespace) -> None:
     cfg = store.get()
 
     fields: dict = {"compress_prose": (value == "on")}
-    if value == "on" and not cfg.compress_enabled:
-        fields["compress_enabled"] = True
+    if value == "on":
+        # Prose (Layer 2) only fires in aggressive mode, so turning it on sets a
+        # COHERENT state — it can never be left enabled-but-inert in safe mode.
+        if not cfg.compress_enabled:
+            fields["compress_enabled"] = True
+        if cfg.compress_mode != "aggressive":
+            fields["compress_mode"] = "aggressive"
 
     try:
         cfg = dataclasses.replace(cfg, **fields)
@@ -129,13 +134,18 @@ def cmd_compress_prose(args: Namespace) -> None:
         sys.exit(1)
 
     if use_json:
-        print(json.dumps({"status": "ok", "compress_prose": value == "on"}))
+        print(json.dumps({
+            "status": "ok",
+            "compress_prose": value == "on",
+            "compress_mode": cfg.compress_mode,
+        }))
         return
 
     print(f"Prose compression (LLMLingua-2): {'ENABLED' if value == 'on' else 'DISABLED'}.")
     if value == "on":
-        print("  Requires: compress_mode=aggressive and llmlingua package installed.")
-        print("  Run: slm compress mode aggressive  (if not already set)")
-    if value == "on" and "compress_enabled" in fields:
-        print("  (also enabled global compress)")
+        if "compress_mode" in fields:
+            print("  Compression mode set to 'aggressive' (required for Layer 2).")
+        print("  Requires the llmlingua package for lossy prose compression.")
+        if "compress_enabled" in fields:
+            print("  (also enabled global compression)")
     print("Daemon hot-reload: active within 2s.")

package/src/superlocalmemory/cli/loop_cmd.py

@@ -0,0 +1,192 @@
+"""``slm loop`` — inspect and demonstrate bounded loops backed by SLM memory.
+
+Subcommands:
+
+* ``slm loop demo``            run a built-in, keyless convergence demo (stub
+                              proposer + deterministic gate) and persist every
+                              lap to SLM memory. Proves the engine + ledger
+                              end to end without a credentialed agent.
+* ``slm loop history [--name]`` list recorded loop runs from SLM memory.
+* ``slm loop show <run_id>``   show every lap of one run.
+
+The durable value here is that a loop's history lives in the same SLM data
+root as everything else the agent remembers — queryable via ``slm recall`` and
+visible in the dashboard. Reads and the demo run through an in-process engine
+store rooted at the active data root (``SLM_DATA_DIR`` or
+``~/.superlocalmemory``); point ``SLM_DATA_DIR`` elsewhere to sandbox a run.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from argparse import Namespace
+from pathlib import Path
+from typing import Any
+
+from superlocalmemory.loops import (
+    Bounds,
+    LapResult,
+    SLMMemoryLedger,
+    Verdict,
+    open_engine_store,
+    run_bounded_loop,
+)
+
+
+def _data_root() -> Path:
+    value = (
+        os.environ.get("SLM_DATA_DIR")
+        or os.environ.get("SL_MEMORY_PATH")
+        or os.environ.get("SLM_HOME")
+    )
+    return Path(value).expanduser() if value else Path.home() / ".superlocalmemory"
+
+
+class _FailOpenLedger:
+    """Wrap a ledger so a memory write hiccup never aborts a running loop.
+
+    A ledger is observability; the loop's correctness comes from the gate.
+    Write errors are counted and surfaced after the run rather than raised
+    mid-flight, so we never silently pretend they did not happen.
+    """
+
+    def __init__(self, inner: Any) -> None:
+        self._inner = inner
+        self.write_errors: list[str] = []
+
+    def record(self, entry: Any) -> None:
+        try:
+            self._inner.record(entry)
+        except Exception as exc:  # pragma: no cover - defensive path
+            self.write_errors.append(f"lap {getattr(entry, 'lap', '?')}: {exc}")
+
+    def laps(self, run_id: str) -> list:
+        return self._inner.laps(run_id)
+
+    def runs(self, name: str) -> list:
+        return self._inner.runs(name)
+
+
+def _open_ledger() -> tuple[SLMMemoryLedger, Any]:
+    store = open_engine_store(_data_root() / "memory.db")
+    return SLMMemoryLedger(store), store
+
+
+def cmd_loop(args: Namespace) -> None:
+    action = getattr(args, "loop_command", None)
+    if action == "demo":
+        _cmd_demo(args)
+    elif action == "history":
+        _cmd_history(args)
+    elif action == "show":
+        _cmd_show(args)
+    else:
+        print("Usage: slm loop {demo|history|show} [options]")
+
+
+def _cmd_demo(args: Namespace) -> None:
+    """Run the convergence demo: the gate fails twice, then passes on lap 3."""
+    iterations = int(getattr(args, "iterations", 10) or 10)
+    as_json = bool(getattr(args, "json", False))
+    pass_on = 3
+
+    ledger, store = _open_ledger()
+    guarded = _FailOpenLedger(ledger)
+    try:
+        outcome = run_bounded_loop(
+            "convergence-demo",
+            bounds=Bounds(max_iterations=iterations),
+            runner=lambda lap: LapResult(changed=True, tokens=8),
+            gate=lambda lap: Verdict(lap >= pass_on, f"demo gate: lap {lap}"),
+            ledger=guarded,
+        )
+        laps = guarded.laps(outcome.run_id)
+    finally:
+        store.close()
+
+    if as_json:
+        print(json.dumps({
+            "status": outcome.status.value,
+            "reason": outcome.reason,
+            "laps": outcome.laps,
+            "run_id": outcome.run_id,
+            "ledger": [
+                {"lap": e.lap, "decision": e.decision, "passed": e.passed}
+                for e in laps
+            ],
+            "write_errors": guarded.write_errors,
+        }, indent=2))
+        return
+
+    mark = "✓" if outcome.ok else "✗"
+    print(f"{mark} [{outcome.status.value}] {outcome.reason} (laps: {outcome.laps})")
+    for e in laps:
+        gate = "gate-pass" if e.passed else "gate-fail"
+        print(f"   lap {e.lap}: {e.decision:<8} {gate}  {e.detail}")
+    print(f"run_id: {outcome.run_id}  (recall with tag loop:convergence-demo)")
+    if guarded.write_errors:
+        print(f"WARNING: {len(guarded.write_errors)} ledger write error(s): "
+              f"{guarded.write_errors[0]}")
+
+
+def _cmd_history(args: Namespace) -> None:
+    name = getattr(args, "name", None) or "convergence-demo"
+    as_json = bool(getattr(args, "json", False))
+    ledger, store = _open_ledger()
+    try:
+        run_ids = ledger.runs(name)
+        rows = []
+        for rid in run_ids:
+            laps = ledger.laps(rid)
+            last = laps[-1] if laps else None
+            rows.append({
+                "run_id": rid,
+                "laps": len(laps),
+                "final": last.decision if last else "unknown",
+                "ts": last.ts if last else "",
+            })
+    finally:
+        store.close()
+
+    if as_json:
+        print(json.dumps({"name": name, "runs": rows}, indent=2))
+        return
+    if not rows:
+        print(f"No recorded runs for loop '{name}'.")
+        return
+    print(f"Runs for loop '{name}':")
+    for r in rows:
+        print(f"  {r['run_id']:<28} laps={r['laps']:<3} final={r['final']:<8} {r['ts']}")
+
+
+def _cmd_show(args: Namespace) -> None:
+    run_id = getattr(args, "run_id", None)
+    as_json = bool(getattr(args, "json", False))
+    if not run_id:
+        print("Usage: slm loop show <run_id>")
+        return
+    ledger, store = _open_ledger()
+    try:
+        laps = ledger.laps(run_id)
+    finally:
+        store.close()
+
+    if as_json:
+        print(json.dumps({
+            "run_id": run_id,
+            "laps": [
+                {"lap": e.lap, "ts": e.ts, "decision": e.decision,
+                 "passed": e.passed, "detail": e.detail, "budget": e.budget}
+                for e in laps
+            ],
+        }, indent=2))
+        return
+    if not laps:
+        print(f"No ledger entries for run '{run_id}'.")
+        return
+    print(f"Loop run {run_id} ({laps[0].name}):")
+    for e in laps:
+        gate = "gate-pass" if e.passed else "gate-fail"
+        print(f"  lap {e.lap}: {e.decision:<8} {gate}  {e.detail}  "
+              f"[tokens={e.budget.get('tokens', 0)}]")

package/src/superlocalmemory/cli/main.py

@@ -80,6 +80,8 @@ _NO_DAEMON_COMMANDS = {
     "wrap",
     # V3.6 Optimize commands that are config read/write only.
     "optimize", "cache", "compress", "help-optimize",
+    # Bounded loops use an in-process engine store, not the daemon.
+    "loop",
     # Lifecycle orchestration must run before any global auto-start hook.
     "serve", "restart",
 }
@@ -276,6 +278,14 @@ def main() -> None:
     db_scale_p.add_argument("--stage-id", help="Stage identifier required by verify/promote")
     db_scale_p.add_argument("--backup-id", help="Backup identifier required by rollback")
 
+    # -- Mesh inspection (v3.7.9, M-03) --------------------------------
+    mesh_p = sub.add_parser("mesh", help="Inspect the local agent mesh (status/peers)")
+    mesh_p.add_argument(
+        "mesh_action",
+        choices=("status", "peers"),
+        help="status: broker health + stats; peers: active peer sessions",
+    )
+
     # -- Memory Operations ---------------------------------------------
     remember_p = sub.add_parser("remember", help="Store a memory (extracts facts, builds graph)")
     remember_p.add_argument("content", help="Content to remember")
@@ -304,9 +314,15 @@ def main() -> None:
         help=f"Max results (default {CANONICAL_RECALL_LIMIT})",
     )
     recall_p.add_argument("--json", action="store_true", help="Output structured JSON (agent-native)")
+    recall_p.add_argument(
+        "--window", default="",
+        help="Restrict results to an event-time range: a relative span "
+             "(24h, 7d, 30d, 1y) or an explicit range (2026-07-01..2026-07-31). "
+             "Default: no time filter.",
+    )
     recall_p.add_argument(
         "--fast", action="store_true",
-        help="Skip spreading activation and remote agentic verification for a "
+        help="Skip graph-assisted candidate expansion and remote agentic verification for a "
              "latency-bounded response. Other configured retrieval channels still run. "
              "Use when you need recall before a tool call (e.g. before WebSearch).",
     )
@@ -332,8 +348,8 @@ def main() -> None:
     )
 
     forget_p = sub.add_parser("forget", help="Delete memories matching a query (fuzzy)")
-    forget_p.add_argument("query", help="Query to match for deletion")
-    forget_p.add_argument("--dry-run", action="store_true", default=False, help="Preview matches without deleting")
+    forget_p.add_argument("query", nargs="?", default=None, help="Query to match for deletion. Optional with --dry-run (previews all memories).")
+    forget_p.add_argument("--dry-run", action="store_true", default=False, help="Preview matches without deleting. With no query, previews every memory.")
     forget_p.add_argument("--yes", "-y", action="store_true", help="Skip confirmation prompt")
     forget_p.add_argument("--json", action="store_true", help="Output structured JSON (agent-native)")
 
@@ -361,7 +377,7 @@ def main() -> None:
         help="Show extended status: migration log, daemon port, disabled marker, last version",
     )
 
-    health_p = sub.add_parser("health", help="Math layer health (Fisher-Rao, Sheaf, Langevin)")
+    health_p = sub.add_parser("health", help="Math layer health (scoring, consistency, and lifecycle layers)")
     health_p.add_argument("--json", action="store_true", help="Output structured JSON (agent-native)")
 
     trace_p = sub.add_parser("trace", help="Recall with per-channel score breakdown")
@@ -774,6 +790,25 @@ def main() -> None:
 
     # ---- end SLM v3.6 Optimize subcommands ----
 
+    # slm loop demo|history|show — bounded, gate-verified agent loops (v3.8.0)
+    loop_p = sub.add_parser(
+        "loop",
+        help="Bounded loops: gate-verified agent loops with an SLM-backed ledger",
+    )
+    loop_sub = loop_p.add_subparsers(dest="loop_command", title="loop subcommands")
+    loop_demo_p = loop_sub.add_parser(
+        "demo", help="Run the keyless convergence demo (proves engine + ledger)")
+    loop_demo_p.add_argument(
+        "--iterations", type=int, default=10, help="Max iterations (default: 10)")
+    loop_hist_p = loop_sub.add_parser("history", help="List recorded loop runs")
+    loop_hist_p.add_argument(
+        "--name", default=None, help="Loop name (default: convergence-demo)")
+    loop_show_p = loop_sub.add_parser("show", help="Show every lap of one run")
+    loop_show_p.add_argument("run_id", help="Run id (from history)")
+    for _sp in loop_sub.choices.values():
+        _sp.add_argument("--json", action="store_true",
+                         help="Output structured JSON (agent-native)")
+
     args = parser.parse_args()
 
     if not args.command:

package/src/superlocalmemory/cli/mesh_cmd.py

@@ -0,0 +1,38 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later
+"""`slm mesh` — inspect the local agent mesh from the terminal (M-03, v3.7.9).
+
+Before 3.7.9 the mesh was reachable only via MCP tools, the dashboard, and
+Claude Code skills — there was no terminal command to check broker health or
+list peer sessions. This is a thin, read-only wrapper over the same
+capability-authenticated `/mesh/*` daemon endpoints the MCP tools use.
+"""
+from __future__ import annotations
+
+import json
+from argparse import Namespace
+
+_ACTION_ENDPOINTS = {
+    "status": "/mesh/status",
+    "peers": "/mesh/peers",
+}
+
+
+def cmd_mesh(args: Namespace) -> int:
+    action = getattr(args, "mesh_action", None)
+    endpoint = _ACTION_ENDPOINTS.get(action)
+    if endpoint is None:
+        print("Usage: slm mesh {status|peers}")
+        return 2
+
+    from superlocalmemory.cli.daemon import daemon_request
+
+    result = daemon_request("GET", endpoint)
+    if result is None:
+        print(
+            "Mesh: cannot reach the daemon broker. Is the daemon running? "
+            "(slm serve start)"
+        )
+        return 1
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0

package/src/superlocalmemory/cli/optimize_cmd.py

@@ -98,6 +98,9 @@ def cmd_optimize_status(args: Namespace) -> None:
     print(f"  Compress:  {'enabled' if cfg.compress_enabled else 'disabled'}"
           f"  (mode: {cfg.compress_mode},"
           f" prose/L2: {'ON' if cfg.compress_prose else 'OFF'})")
+    if cfg.compress_prose or cfg.compress_mode == "aggressive":
+        print("             note: the live proxy applies LOSSLESS compression only;"
+              " lossy Layer-2 (prose) runs via the slm_compress tool.")
     proxy_status = f"running on :{OPTIMIZE_DEFAULT_PORT}" if proxy_running else "not running"
     print(f"  Proxy:     {proxy_status}")
     print(f"  Config:    ~/.superlocalmemory/optimize.json  (version {cfg.config_version})")

package/src/superlocalmemory/cli/pending_store.py

@@ -43,6 +43,7 @@ _MAX_RETRY_DELAY_SECONDS = 3600
 _SCHEMA = """
 CREATE TABLE IF NOT EXISTS pending_memories (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
+    profile_id TEXT NOT NULL DEFAULT 'default',
     content TEXT NOT NULL,
     tags TEXT DEFAULT '',
     metadata TEXT DEFAULT '{}',
@@ -62,6 +63,12 @@ def _get_db(base_dir: Path | None = None) -> sqlite3.Connection:
     db_path = d / _PENDING_DB
     conn = sqlite3.connect(str(db_path), timeout=5)
     conn.execute("PRAGMA journal_mode=WAL")
+    # C4: pending queue can hold not-yet-materialized memory content owner-only.
+    try:
+        from superlocalmemory.core.security_primitives import harden_db_perms
+        harden_db_perms(db_path)
+    except Exception:
+        pass
     conn.execute(_SCHEMA)
     columns = {
         row[1]
@@ -73,6 +80,15 @@ def _get_db(base_dir: Path | None = None) -> sqlite3.Connection:
             "next_retry_at REAL DEFAULT 0"
         )
         conn.commit()
+    # Per-profile isolation: a queued item must materialize under the profile
+    # that was active when it was enqueued — never under whatever profile is
+    # active at drain time. Existing rows backfill to 'default'.
+    if "profile_id" not in columns:
+        conn.execute(
+            "ALTER TABLE pending_memories ADD COLUMN "
+            "profile_id TEXT NOT NULL DEFAULT 'default'"
+        )
+        conn.commit()
     # Pre-V3.7 rows were terminally hidden after three failures. Restore them
     # to the retry queue; M018 makes replay idempotent and no raw evidence may
     # remain stranded solely because an older version exhausted its counter.
@@ -89,8 +105,12 @@ def store_pending(
     tags: str = "",
     metadata: dict | None = None,
     base_dir: Path | None = None,
+    profile_id: str = "default",
 ) -> int:
-    """Store content in pending table. Returns the row ID.
+    """Store content in pending table under a profile. Returns the row ID.
+
+    ``profile_id`` captures the profile active at ENQUEUE time so a later
+    profile switch can never redirect this memory to a different profile.
 
     This is intentionally FAST — no engine init, no embedding, no model loading.
     Just a raw SQLite INSERT (~0.1s).
@@ -98,9 +118,11 @@ def store_pending(
     conn = _get_db(base_dir)
     try:
         cur = conn.execute(
-            "INSERT INTO pending_memories (content, tags, metadata, created_at, status) "
-            "VALUES (?, ?, ?, ?, 'pending')",
-            (content, tags, json.dumps(metadata or {}), time.strftime("%Y-%m-%dT%H:%M:%S")),
+            "INSERT INTO pending_memories "
+            "(profile_id, content, tags, metadata, created_at, status) "
+            "VALUES (?, ?, ?, ?, ?, 'pending')",
+            (profile_id, content, tags, json.dumps(metadata or {}),
+             time.strftime("%Y-%m-%dT%H:%M:%S")),
         )
         conn.commit()
         return cur.lastrowid or 0
@@ -108,20 +130,34 @@ def store_pending(
         conn.close()
 
 
-def get_pending(base_dir: Path | None = None, limit: int = 50) -> list[dict]:
-    """Get unprocessed pending memories."""
+def get_pending(
+    base_dir: Path | None = None,
+    limit: int = 50,
+    profile_id: str | None = None,
+) -> list[dict]:
+    """Get unprocessed pending memories, optionally scoped to one profile.
+
+    The drain passes ``profile_id`` = its engine's active profile so it only
+    ever claims items enqueued under that profile. Items for other profiles
+    wait until their profile is active — never materialized under the wrong one.
+    """
     conn = _get_db(base_dir)
     try:
-        rows = conn.execute(
-            "SELECT id, content, tags, metadata, created_at, retry_count "
+        query = (
+            "SELECT id, content, tags, metadata, created_at, retry_count, profile_id "
             "FROM pending_memories WHERE status = 'pending' "
-            "AND COALESCE(next_retry_at, 0) <= ? "
-            "ORDER BY id ASC LIMIT ?",
-            (time.time(), limit),
-        ).fetchall()
+            "AND COALESCE(next_retry_at, 0) <= ?"
+        )
+        params: list = [time.time()]
+        if profile_id is not None:
+            query += " AND profile_id = ?"
+            params.append(profile_id)
+        query += " ORDER BY id ASC LIMIT ?"
+        params.append(limit)
+        rows = conn.execute(query, params).fetchall()
         return [
             {"id": r[0], "content": r[1], "tags": r[2], "metadata": r[3],
-             "created_at": r[4], "retry_count": r[5]}
+             "created_at": r[4], "retry_count": r[5], "profile_id": r[6]}
             for r in rows
         ]
     finally:

package/src/superlocalmemory/cli/proxy_cmd.py

@@ -99,6 +99,10 @@ def cmd_proxy(args: Namespace) -> None:
             print("Or run: slm wrap claude")
             print()
             print("Proxy ready.")
+            print()
+            print("Note: 'slm proxy' enables the proxy independently — it does not")
+            print("flip the master optimize switch, so 'slm optimize status' may")
+            print("show OFF while the proxy is running.")
         else:
             print("Error: proxy failed to start. Check logs.", file=sys.stderr)
             sys.exit(1)

package/src/superlocalmemory/cli/scale_engine_cmd.py

@@ -37,10 +37,16 @@ def cmd_db_scale(args: Namespace) -> int:
             if not args.stage_id:
                 raise ScaleEngineError("promote requires --stage-id (see `slm db scale status`)")
             result = manager.promote(args.stage_id)
+            # The running daemon reads scale_engine_state once at startup; the
+            # promoted Cozo/Lance backends are only wired in on the next start.
+            # Without this flag users see a clean promote and keep hitting
+            # SQLite-only silently (no error, no speedup).
+            result = {**result, "restart_required": True}
         elif action == "rollback":
             if not args.backup_id:
                 raise ScaleEngineError("rollback requires --backup-id (see `slm db scale status`)")
             result = manager.rollback(args.backup_id)
+            result = {**result, "restart_required": True}
         else:
             raise ScaleEngineError(f"unknown Scale Engine action: {action}")
     except (ScaleEngineError, CanonicalVectorError) as exc:

package/src/superlocalmemory/cli/setup_wizard.py

@@ -114,17 +114,19 @@ def _download_model(model_name: str, label: str) -> bool:
     print(f"\n  Downloading {label}: {model_name}")
     print(f"  (this may take a few minutes on first run)\n")
 
+    # H-03: pass the model name as argv, never interpolated into executed
+    # source, so a crafted model_name cannot become arbitrary Python.
     script = (
-        f"import sys; "
-        f"from sentence_transformers import SentenceTransformer; "
-        f"m = SentenceTransformer('{model_name}', trust_remote_code=True); "
-        f"d = m.get_sentence_embedding_dimension(); "
-        f"print(f'OK dim={{d}}'); "
+        "import sys; "
+        "from sentence_transformers import SentenceTransformer; "
+        "m = SentenceTransformer(sys.argv[1], trust_remote_code=True); "
+        "d = m.get_sentence_embedding_dimension(); "
+        "print(f'OK dim={d}'); "
     )
 
     try:
         result = subprocess.run(
-            [sys.executable, "-c", script],
+            [sys.executable, "-c", script, model_name],
             timeout=600,  # 10 min for large model downloads
             capture_output=False,  # Show download progress
             text=True,
@@ -156,15 +158,16 @@ def _download_reranker(model_name: str) -> bool:
     print(f"\n  Downloading reranker: {model_name}")
     print(f"  (cross-encoder for result re-ranking)\n")
 
+    # H-03: model name via argv, never interpolated into executed source.
     script = (
-        f"from sentence_transformers import CrossEncoder; "
-        f"m = CrossEncoder('{model_name}', trust_remote_code=True); "
-        f"print('OK'); "
+        "import sys; from sentence_transformers import CrossEncoder; "
+        "m = CrossEncoder(sys.argv[1], trust_remote_code=True); "
+        "print('OK'); "
     )
 
     try:
         result = subprocess.run(
-            [sys.executable, "-c", script],
+            [sys.executable, "-c", script, model_name],
             timeout=300,
             capture_output=False,
             text=True,
@@ -195,16 +198,17 @@ def _download_compressor(model_name: str) -> bool:
     print(f"\n  Downloading compression model: {model_name}")
     print(f"  (LLMLingua-2 prose compressor, ~560MB — aggressive mode only)\n")
 
+    # H-03: model name via argv, never interpolated into executed source.
     script = (
-        "from llmlingua import PromptCompressor; "
-        f"PromptCompressor(model_name='{model_name}', use_llmlingua2=True, "
+        "import sys; from llmlingua import PromptCompressor; "
+        "PromptCompressor(model_name=sys.argv[1], use_llmlingua2=True, "
         "device_map='cpu'); "
         "print('OK')"
     )
 
     try:
         result = subprocess.run(
-            [sys.executable, "-c", script],
+            [sys.executable, "-c", script, model_name],
             timeout=900,  # 560MB on a slow link can exceed 5 min
             capture_output=False,
             text=True,
@@ -494,6 +498,11 @@ def run_wizard(auto: bool = False) -> None:
 
     # -- Step 4: Download models --
     print()
+    # H-06 (CVE-2025-14926): a malicious HuggingFace checkpoint can execute code
+    # at load time. SLM only downloads its pinned defaults, but warn users who
+    # point config at a custom model.
+    print("  ⚠ Only install models from sources you trust — a malicious model")
+    print("    checkpoint can run code on your machine at load time. See SECURITY.md.")
     print("─── Step 4/10: Download Embedding Model ───")
 
     if _embedding_is_remote(config):

package/src/superlocalmemory/compliance/audit.py

@@ -92,6 +92,12 @@ class AuditChain:
         conn = sqlite3.connect(path)
         conn.execute("PRAGMA journal_mode=WAL")
         conn.row_factory = sqlite3.Row
+        # C4: audit chain holds a tamper-evident record — keep it owner-only.
+        try:
+            from superlocalmemory.core.security_primitives import harden_db_perms
+            harden_db_perms(path)
+        except Exception:
+            pass
         return conn
 
     def _make_conn(self) -> sqlite3.Connection: