superlocalmemory 3.8.14 → 4.0.0

package/README.md

@@ -5,22 +5,41 @@
   </picture>
 </p>
 
-<h1 align="center">SuperLocalMemory V3.8.14</h1>
-<p align="center"><strong>Enterprise-grade, local-first memory for AI agents and teams.</strong><br/>
-<em>A persistent, auditable long-term brain for your agents that runs on your own infrastructure — with multi-workspace isolation, role-based access, and GDPR + EU AI Act governance controls built in.</em></p>
-<p align="center"><code>v3.8.14</code> — one control plane: auditable retrieval · multi-scope memory (personal / shared / global) · Cache · Compress · trusted-peer Mesh · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
+<h1 align="center">SuperLocalMemory V4.0.0</h1>
+
+<h2 align="center">Rent the LLM. Own the memory.</h2>
+
+<p align="center"><em>Rent an LLM — but own the memory, for your company and for your industry.</em></p>
+
+<p align="center"><strong>The governed memory layer for AI agents: local-first, auditable, and built for the compliance obligations teams now actually carry.</strong><br/>
+Models are interchangeable and rented by the token. What your agents <em>remember</em> is
+yours — it is your customers' data, your retention obligations, and your audit trail. SLM
+keeps that layer on infrastructure you control, with multi-workspace isolation, role-based
+access, and GDPR + EU AI Act governance controls built in.</p>
+
+<p align="center"><strong>The boundary.</strong> SuperLocalMemory starts with a local runtime;
+provider-backed enrichment, cloud backup, connectors, and proxy use are explicit choices.
+Different products solve different boundaries. Published benchmark evidence carried into V4
+comes from the published V3 research architecture; it is not a claim of a newly rerun V4 package benchmark.</p>
+
+<p align="center"><strong>How to check that, rather than believe it.</strong> Every reliability
+guarantee here is stated as a falsifiable invariant, tested under an adversarial condition with a
+negative control, and shipped with the harness that regenerates the evidence:
+<code>python benchmark/run_all.py --trials 200 --output-dir results/</code>. What each experiment
+does <em>not</em> exercise is stated too.</p>
+<p align="center"><code>v4.0.0</code> — one control plane: <strong>SLM-Mesh</strong> peer coordination · multi-scope memory (personal / shared / global) · profiles · Cache · Compress · 7-layer retrieval · code graph · Entity Explorer · skill evolution · Modes A/B/C · GDPR retention &amp; audit chain · bounded loops — across CLI, MCP, dashboard, the <strong>Claude plugin</strong>, the <strong>Codex add-on</strong>, and documented IDE integrations.<br/>
 Proxy: <code>slm wrap claude</code> &nbsp;·&nbsp; MCP: add <code>slm_compress</code> to your config &nbsp;·&nbsp; Skill: zero-config</p>
 <p align="center"><strong>3 public research preprints</strong> (arXiv + Zenodo archives) · <a href="https://arxiv.org/abs/2603.02240">arXiv:2603.02240</a> · <a href="https://arxiv.org/abs/2603.14588">arXiv:2603.14588</a> · <a href="https://arxiv.org/abs/2604.04514">arXiv:2604.04514</a></p>
 
 <p align="center">
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v3.8.14-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v3.8.14 — Current Release"/></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/v4.0.0-Current_Release-2ea44f?style=for-the-badge&logo=checkmarx&logoColor=white" alt="v4.0.0 — Current Release"/></a>
   <a href="https://arxiv.org/abs/2603.14588"><img src="https://img.shields.io/badge/arXiv-2603.14588-b31b1b?style=for-the-badge&logo=arxiv&logoColor=white" alt="arXiv Paper"/></a>
   <a href="#three-surfaces-proxy--mcp-tools--skill"><img src="https://img.shields.io/badge/Proxy_|_MCP_|_Skill-22c55e?style=for-the-badge" alt="Three Surfaces: Proxy, MCP Tools, Skill"/></a>
   <a href="https://pypi.org/project/superlocalmemory/"><img src="https://img.shields.io/pypi/v/superlocalmemory?style=for-the-badge&logo=pypi&logoColor=white" alt="PyPI"/></a>
   <a href="https://www.npmjs.com/package/superlocalmemory"><img src="https://img.shields.io/npm/v/superlocalmemory?style=for-the-badge&logo=npm&logoColor=white" alt="npm"/></a>
   <a href="https://www.gnu.org/licenses/agpl-3.0"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg?style=for-the-badge" alt="AGPL v3"/></a>
   <a href="#privacy-controls-and-operating-modes"><img src="https://img.shields.io/badge/Privacy-Deployment_Assessed-brightgreen?style=for-the-badge" alt="Privacy controls require deployment assessment"/></a>
-  <a href="#teams-and-enterprise-memory-v380"><img src="https://img.shields.io/badge/Enterprise-GDPR_%7C_EU_AI_Act-0b5394?style=for-the-badge" alt="Enterprise governance: GDPR and EU AI Act controls"/></a>
+  <a href="#teams-and-enterprise-memory-v4"><img src="https://img.shields.io/badge/Enterprise-GDPR_%7C_EU_AI_Act-0b5394?style=for-the-badge" alt="Enterprise governance: GDPR and EU AI Act controls"/></a>
   <a href="https://superlocalmemory.com"><img src="https://img.shields.io/badge/Web-superlocalmemory.com-ff6b35?style=for-the-badge" alt="Website"/></a>
   <a href="#dual-interface-mcp--cli"><img src="https://img.shields.io/badge/MCP-Native-blue?style=for-the-badge" alt="MCP Native"/></a>
   <a href="#dual-interface-mcp--cli"><img src="https://img.shields.io/badge/CLI-Agent--Native-green?style=for-the-badge" alt="CLI Agent-Native"/></a>
@@ -35,21 +54,24 @@ SuperLocalMemory is an enterprise-grade, local-first memory control plane for AI
 
 Agent-memory systems make different storage, model-provider, and deployment trade-offs. SuperLocalMemory starts with a local runtime and makes provider-backed enrichment, cloud backup, connectors, and proxy use explicit choices.
 
-Different products solve different boundaries. The published benchmark evidence carried into V3.8.0 is protocol-scoped evidence from the published V3 research, not a claim of a newly rerun V3.8.0 package benchmark.
+Different products solve different boundaries. The published LoCoMo benchmark evidence in this README is protocol-scoped evidence from the published V3 research architecture; it is carried forward for continuity and is not a claim of a newly rerun V4 package benchmark.
 
-SuperLocalMemory V3 combines conventional dense and lexical retrieval with graph, temporal, associative, and statistical relevance scoring. The default local runtime does not require Docker, a separately operated graph database, or an API key.
+SuperLocalMemory V4 combines conventional dense and lexical retrieval with graph, temporal, associative, and statistical relevance scoring in a **7-layer** control plane (admission → queryable core → enrichment → brain → multi-channel retrieval → context safety → operations). The default local runtime does not require Docker, a separately operated graph database, or an API key.
 
 **Memory with a sense of time.** SLM does not only store *what* an agent learned — it records *when*. Every fact carries ingestion timing and provenance; recall runs a dedicated temporal candidate channel alongside semantic, lexical, and associative retrieval; scenes and entity timelines reconstruct sequence; and the lifecycle lets neglected memory decay and self-archive instead of growing without bound. Time is a first-class ranking and lifecycle signal rather than a timestamp column an agent never reads — which is what lets a long-lived agent reason about how its context changed, not only what it currently holds.
 
-**What V3.8.0 added.** The 3.8.0 capability release introduced the following
-foundation; 3.8.1 is the existing-install stability patch for it:
+**What V4.0.0 ships.** V4 is a *governed* local-first control plane — every canonical write is admitted, policy-authorized, tracked as durable per-store obligations (lexical, temporal, vector), and sealed by a completion manifest, so it is either fully applied or explicitly marked degraded, never silently half-done. Flagship surfaces in this release:
 
-- **Temporal depth** — the time-aware retrieval and lifecycle described above.
-- **Governance & EU compliance** — [team roles, workspace isolation, a login gate, multi-scope memory, GDPR access/erasure/portability rights, a hash-chained audit trail, and per-mode EU AI Act self-assessment](#teams-and-enterprise-memory-v380).
-- **Framework adapters** — [drop-in, engine-backed memory for nine agent frameworks](#framework-adapters-v380).
-- **Bounded loops** — [gate-verified agent loops where an independent check, not the agent's own claim, decides when a task is done](#bounded-loops-v380).
-- **Stronger cache and compression** — exact-match caching with tagged invalidation plus opt-in reversible compression, across proxy, MCP, and skill surfaces.
-- **Stability** — a long defect-and-audit sweep across ingestion, retrieval, mesh, and the dashboard hardens the everyday path.
+- **[SLM-Mesh](#slm-mesh-cross-session--cross-machine-coordination)** — authenticated cross-session and cross-machine peer coordination (messages, locks, shared state, inbox/outbox, optional discovery). Coordination only — not automatic replicated memory.
+- **Multi-scope memory & profiles** — workspaces (profiles) plus `personal` / `shared` / `global` scopes; cross-profile recall is default-deny.
+- **Cache & compression (context optimization)** — exact-match cache with tagged invalidation, safe compression, and opt-in reversible/aggressive paths across proxy, MCP, and skill surfaces.
+- **Entity Explorer & skill evolution** — compiled entity summaries/timelines; opt-in skill lineage, budgets, and verification outcomes.
+- **Modes A / B / C** — local-only (A), on-device LLM enrichment (B), provider-assisted (C). An operating mode records technical locality facts; it does **not** determine EU AI Act legal compliance (that is deployment-context assessment — see [Privacy controls](#privacy-controls-and-operating-modes)).
+- **GDPR posture, retention & audit chain** — export, fail-closed cross-store erasure, retention policies, and a hash-chained audit trail. Engineering controls for compliance programs, not a legal certification.
+- **7-layer retrieval/recall stack & code graph** — multi-channel candidates (semantic, BM25, temporal, Hopfield, spreading activation) plus optional code-graph tools for blast radius and review context.
+- **MCP profiles** — `full` exposes **42** tools (default everyday surface); `power` **54**; `whole` **87** (all registered). Also `core` (14), `code` (24), and `mesh` (8).
+- **Governed write path & verifiable transactions** — admission + policy control, a per-owner obligation ledger, and a hash-sealed completion manifest with a reconciler that redrives unmet obligations.
+- **Self-healing lifecycle & admin remediation** — stale locks cleared on restart; list/resolve stuck operations from CLI, MCP, or the dashboard.
 
 SLM is one strand of Qualixar's work on AI reliability engineering: making agent behavior observable, bounded, and reproducible instead of best-effort.
 
@@ -60,7 +82,7 @@ The architecture evaluated in the V3 paper remains the foundation of this releas
 Different products solve different boundaries. SLM is for developers who want
 one local-first operating control plane—not only an SDK, managed context API,
 or agent runtime. It combines dated evidence, graph-aware retrieval, cache and
-compression controls, trusted-peer Mesh, and MCP/CLI/hooks/dashboard/IDE
+compression controls, **SLM-Mesh**, and MCP/CLI/hooks/dashboard/IDE
 surfaces in one install.
 
 | If your primary need is… | Product boundary to evaluate |
@@ -78,24 +100,24 @@ for current primary sources and protocol-scoped benchmark evidence. A LoCoMo
 percentage is comparable only when the dataset scope, answer model, judge,
 retrieval stack, and release artifact match.
 
-### The V3.8.0 capability architecture
+### The V4 capability architecture
 
 SuperLocalMemory is one local control plane for persistent agent context. It is
 not just a vector store: the same runtime can accept evidence, build and govern
 memory, retrieve bounded evidence for an agent, and expose cache, compression,
-and peer-coordination controls through a CLI, MCP, dashboard, and supported
+and **SLM-Mesh** peer-coordination controls through a CLI, MCP, dashboard, and supported
 IDE integrations.
 
-![SuperLocalMemory V3 capability architecture: modes, seven operating layers, Scale Engine, Mesh, delivery surfaces, and opt-in adapters](docs/assets/slm-v37-capability-architecture.png)
+![SuperLocalMemory V4 capability architecture: modes, seven operating layers, Scale Engine, SLM-Mesh, delivery surfaces, and opt-in adapters](docs/assets/slm-v37-capability-architecture.png)
 
 *Architecture boundary: SQLite + sqlite-vec remain canonical; CozoDB and
-LanceDB are parity-gated projections; Mesh coordinates trusted peers rather
+LanceDB are parity-gated projections; **SLM-Mesh** coordinates trusted peers rather
 than replicating a distributed memory database; connectors are opt-in.*
 
 **Memory boundaries:** profiles isolate workspaces by default. Every memory is
 `personal`, `shared` with named profile readers, or `global`; cross-profile
 recall is default-deny and must be explicitly enabled. This scoped sharing is
-local authorization, not SLM Mesh synchronization. See
+local authorization, not **SLM-Mesh** synchronization. See
 [shared-memory.md](docs/shared-memory.md).
 
 ```text
@@ -130,7 +152,7 @@ health surfaces expose the stages actually completed by the installed runtime.
 | **Knowledge graph and entities** | Canonical entities, aliases, entity profiles, graph edges, scenes, timelines, explorer and graph APIs | Stored/derived graph data is evidence, not an instruction authority. |
 | **Scale Engine** | SQLite + sqlite-vec are canonical. CozoDB graph and LanceDB vector projections are managed with prepare → verify → promote → rollback; a structurally detected pre-v3.7 projection can be explicitly adopted. | Promotion is parity-gated and crash-recoverable. Legacy adoption preserves the prior projection as a rollback backup; repeated physical edge rows normalize to one logical edge with the strongest weight. |
 | **Optimize** | Exact cache, tagged invalidation, safe compression, opt-in aggressive prose compression, CCR originals, proxy/MCP/skill surfaces | Only proxy intercepts a primary provider turn. MCP/skill cache results explicitly routed through SLM. |
-| **Mesh** | Authenticated peer messages, inbox/outbox, locks, offline queue, optional discovery and mesh MCP tools | Mesh is coordination, not automatic replicated memory or conflict resolution. |
+| **SLM-Mesh** | Authenticated peer messages, inbox/outbox, locks, offline queue, optional discovery and mesh MCP tools | SLM-Mesh is coordination, not automatic replicated memory or conflict resolution. |
 | **Governance and operations** | Provenance, audit/retention/policy surfaces, export/erasure controls, diagnostics, health, backups and daemon lifecycle | These are engineering controls, not a legal certification. |
 | **Integrations** | CLI, Python SDK, MCP HTTP/stdio, Claude plugin, Codex add-on, supported IDE configurations, Gmail/Calendar/transcript adapters | Hooks, IDE edits, connectors, and networked adapters require explicit operator activation. |
 
@@ -146,7 +168,7 @@ health surfaces expose the stages actually completed by the installed runtime.
 | Operations | ingestion-operation state, traces, maintenance and lifecycle work |
 | Entity Explorer and Skill Evolution | compiled entity summaries/timelines; opt-in skill lineage, budgets and verification outcomes |
 | Multi-Agent Memory | per-agent write activity and attribution; memories stamped by `SLM_AGENT_ID`, agent write counts, and trust signals |
-| Mesh Peers | configured peers, inbox/outbox, pending coordination and locks |
+| SLM-Mesh Peers | configured peers, inbox/outbox, pending coordination and locks |
 | Settings and Optimize | mode/provider/configuration; cache, compression and savings telemetry |
 
 Dashboard visibility is not a substitute for runtime proof: use `slm doctor`,
@@ -159,9 +181,9 @@ deployment.
 
 **[Watch the SuperLocalMemory demo on YouTube](https://www.youtube.com/watch?v=PMWW_ypsL60)** — a five-minute walkthrough of installation, setup, recall, cache, and compression. The video shows a product walkthrough; use the commands and release notes in this README as the current release contract.
 
-### Published LoCoMo evidence (V3 architecture, carried into V3.8.0)
+### Published LoCoMo evidence (V3 architecture, carried into V4)
 
-The V3 paper evaluates the architecture carried into V3.8.0. Every figure below
+The V3 paper evaluates the multi-channel architecture that V4 still runs. Every figure below
 is protocol-scoped, so a reader can distinguish local retrieval, answer
 construction, and cloud-assisted evaluation rather than treating unlike runs as
 one score.
@@ -182,7 +204,7 @@ information-geometric layers versus **58.9%** without them: **+12.7pp**.
 See [arXiv:2603.14588](https://arxiv.org/abs/2603.14588) and the [official
 LoCoMo paper](https://arxiv.org/abs/2402.17753) for the full protocol,
 ablation table, and limitations. These are published V3 architecture results
-carried into V3.8.0—not a substitute for a newly rerun release-artifact benchmark.
+carried into V4—not a substitute for a newly rerun release-artifact benchmark.
 
 ---
 
@@ -294,10 +316,6 @@ quality must be evaluated for the target client and workload; V3.8.0 publishes n
 
 **Multilingual models:** configure an OpenAI-compatible embedding endpoint such as Ollama, vLLM, LiteLLM, `bge-m3`, `multilingual-e5`, or `Qwen3-Embedding`. Language coverage and retrieval quality depend on the selected model and should be evaluated for the deployment corpus.
 
-<a id="remote-embedding-and-rerank-endpoints"></a>
-
-**Remote embedding + rerank endpoints.** The bundled reranker `cross-encoder/ms-marco-MiniLM-L-12-v2` is **English-only**, so a Chinese, Japanese, or Arabic corpus is scored by a model that cannot read it. Set `retrieval.cross_encoder_backend: "openai"` plus `retrieval.cross_encoder_endpoint` to route reranking to any Cohere-shaped `POST /v1/rerank` service — llama-server, text-embeddings-inference, Infinity — running a multilingual model such as `BAAI/bge-reranker-v2-m3` (v3.8.12, [#105](https://github.com/qualixar/superlocalmemory/issues/105); the same escape hatch embeddings got in v3.4.24, [#16](https://github.com/qualixar/superlocalmemory/issues/16)). No subprocess and no local model download. An unreachable, slow, or malformed endpoint logs an error and returns fusion-ranked results — SLM never silently substitutes the local English model. Keys, auth, and failure semantics: **[docs/configuration.md](docs/configuration.md#remote-embedding-and-rerank-endpoints)**.
-
 ### Cache + Compress
 
 <a id="three-surfaces-proxy--mcp-tools--skill"></a>
@@ -327,11 +345,12 @@ actual cost and latency savings depend on the intercepted surface and provider.
 
 **Savings dashboard:** `slm optimize savings --since 7` — live USD/INR/tokens saved. Hot-reload config, fail-open.
 
-### Mesh
+### SLM-Mesh (cross-session / cross-machine coordination)
 
 <a id="multi-machine-mesh-coordination"></a>
+<a id="slm-mesh-cross-session--cross-machine-coordination"></a>
 
-Mesh provides authenticated coordination messages between configured peers, with an offline queue and optional mDNS discovery (`SLM_MESH_DISCOVERY=on`). It is not a replicated or conflict-resolving distributed-memory database.
+**SLM-Mesh** is the V4 peer-coordination plane: authenticated messages, locks, shared lightweight state, inbox/outbox, and an offline queue between configured peers (same machine sessions or cross-machine). Optional mDNS discovery (`SLM_MESH_DISCOVERY=on`). It is **not** a replicated or conflict-resolving distributed-memory database — multi-scope memory sharing is a separate local-authorization feature.
 
 ```bash
 # Machine A (broker)
@@ -345,7 +364,7 @@ export SLM_MESH_SHARED_SECRET=my-secret-key
 slm init
 ```
 
-8 mesh MCP tools: `mesh_summary`, `mesh_peers`, `mesh_send`, `mesh_inbox`, `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`.
+Eight **SLM-Mesh** MCP tools: `mesh_summary`, `mesh_peers`, `mesh_send`, `mesh_inbox`, `mesh_state`, `mesh_lock`, `mesh_events`, `mesh_status`.
 
 Full docs: [docs/multi-machine.md](docs/multi-machine.md) · [docs/distributed-deployment.md](docs/distributed-deployment.md)
 
@@ -353,6 +372,8 @@ Full docs: [docs/multi-machine.md](docs/multi-machine.md) · [docs/distributed-d
 
 ## Install Paths
 
+> **V4 platform support:** Apple Silicon macOS, 64-bit Windows, and 64-bit Linux. Intel Mac and 32-bit Windows are not supported by the patched `cryptography` 50 runtime.
+
 | Path | Command | When |
 |:-----|:--------|:-----|
 | **npm global CLI** (primary) | `npm install -g superlocalmemory` | Node 18+; package-owned virtual environment; system Python is not modified; run `slm setup` explicitly afterward |
@@ -398,10 +419,10 @@ Control tool surface via `SLM_MCP_PROFILE`:
 |:--------|:-----:|:---------|
 | `core` | 14 | Memory, session, and optimize core |
 | `code` | 24 | Core + code-graph tools + profile switching + bounded loops |
-| `mesh` | 8 | Mesh-only — multi-machine coordination |
+| `mesh` | 8 | SLM-Mesh only — multi-session / multi-machine coordination |
 | `full` | 42 | Memory + optimize + evolution + mesh + bounded loops |
 | `power` | 54 | Full + administration, lifecycle, and diagnostics |
-| `whole` | all registered | Every registered MCP tool |
+| `whole` | 87 | Every registered MCP tool |
 
 **Precedence:** `ALL` > `TOOLS` > `PROFILE` > `default`
 
@@ -514,9 +535,9 @@ Available controls include local export and erasure commands, hash-chained audit
 
 ---
 
-## Teams and Enterprise Memory (v3.8.0)
+## Teams and Enterprise Memory (V4)
 
-V3.8.0 adds multi-user, multi-workspace controls for teams and organizations. These are opt-in — personal single-user installs work exactly as before with no required login.
+V4 includes multi-user, multi-workspace controls for teams and organizations (introduced on the 3.8 line and retained). These are opt-in — personal single-user installs work exactly as before with no required login.
 
 ### Users and roles
 
@@ -570,12 +591,9 @@ These are engineering controls. Compliance depends on deployment configuration,
 
 ### EU AI Act mode verification
 
-SLM includes a per-mode EU AI Act self-assessment. The `EUAIActChecker` produces a compliance report for the active operating mode — risk category, whether data stays local, whether generative AI is used, and transparency / human-oversight signals:
+SLM includes a per-mode EU AI Act *technical posture* report (`EUAIActChecker`). It records facts the runtime can know — whether data is configured to stay local, whether generative AI is used, and that transparency / human-oversight need deployment evidence.
 
-- **Mode A (Local Guardian)** and **Mode B (Smart Local)** — assessed as compliant: memory processing stays local and uses no generative AI.
-- **Mode C (Provider-assisted)** — flagged non-compliant, because query or enrichment content is sent to a cloud model provider.
-
-This is operator self-assessment tooling, not a legal certification or conformity assessment; actual EU AI Act obligations depend on your system, deployment, and role. See [docs/compliance.md](docs/compliance.md).
+**An operating mode does not establish legal compliance under the EU AI Act.** Legal risk classification and conformity assessment depend on intended purpose, affected persons, sector, deployment context, and operator controls. The checker therefore returns `compliant=None` / risk category `undetermined` for every mode and always requires deployment-context review. Mode A/B/C only change technical locality and enrichment options (for example Mode C may send content to a configured provider). See [docs/compliance.md](docs/compliance.md) and `src/superlocalmemory/core/modes.py`.
 
 ### Deployment tiers
 
@@ -594,7 +612,7 @@ Full reference: [docs/rbac-teams.md](docs/rbac-teams.md) · [docs/deployment-tie
 
 ---
 
-## Bounded Loops (v3.8.0)
+## Bounded Loops (V4)
 
 A bounded loop terminates only when an **independent gate** passes — a test
 suite exit code, a linter, a JSON-schema check, or an SLM-recall condition.
@@ -625,7 +643,7 @@ Multi-Agent Memory workspace.
 
 ---
 
-## Framework Adapters (v3.8.0)
+## Framework Adapters (V4)
 
 SLM ships nine framework adapters under `ide/integrations/`. Each adapter
 wires SLM as the memory and history provider for the respective framework
@@ -687,32 +705,16 @@ SuperLocalMemory is backed by three preprints by Varun Pratap Bhardwaj (2026):
 Use the citation metadata on the linked arXiv or Zenodo records.
 
 ## Support / License / Qualixar
-
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines. [Wiki](https://github.com/qualixar/superlocalmemory/wiki) for detailed documentation.
-
 GNU Affero General Public License v3.0 (AGPL-3.0). See [LICENSE](LICENSE).
-
 For commercial licensing (closed-source, proprietary, or hosted use), see [COMMERCIAL-LICENSE.md](COMMERCIAL-LICENSE.md) or contact varun.pratap.bhardwaj@gmail.com.
-
 Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar.
-
 Part of [Qualixar](https://qualixar.com) · Author: [Varun Pratap Bhardwaj](https://varunpratap.com)
-
-### Acknowledgments
-
-- **[Everything Claude Code (ECC)](https://github.com/affaan-m/everything-claude-code)** inspired SLM's skill-observation patterns; SLM can ingest ECC observations with `slm ingest --source ecc`.
-- **[HKUDS/OpenSpace](https://github.com/HKUDS/OpenSpace)** informed the skill-evolution verification design (arXiv:2604.01687).
-
-### Qualixar AI Agent Reliability Platform
-
-Qualixar builds open-source infrastructure for AI reliability engineering.
-Start at **[qualixar.com](https://qualixar.com)** or browse the
-[Qualixar research archive](https://huggingface.co/Qualixar).
+Acknowledgments: [Everything Claude Code](https://github.com/affaan-m/everything-claude-code) informed skill observation; [HKUDS/OpenSpace](https://github.com/HKUDS/OpenSpace) informed skill-evolution verification.
+Qualixar builds open-source infrastructure for AI reliability engineering. Start at [qualixar.com](https://qualixar.com) or browse the [research archive](https://huggingface.co/Qualixar).
 
 ## Star This Project
 
 If this project solves a real problem for you, **please star the repo** — it helps other developers discover Qualixar and signals that the AI agent reliability community is growing.
 
 [![Star SuperLocalMemory on GitHub](https://img.shields.io/github/stars/qualixar/superlocalmemory?style=for-the-badge&logo=github&label=Star%20on%20GitHub)](https://github.com/qualixar/superlocalmemory)
-
-The live Star History chart is intentionally not embedded: its upstream service timed out during release validation. The link above is the stable, direct way to star and follow the repository.

package/docs/pi-dev-integration.md

@@ -1,5 +1,5 @@
 # pi.dev Integration
-> SuperLocalMemory V3 Documentation
+> SuperLocalMemory V4 Documentation
 > https://superlocalmemory.com | Part of Qualixar
 
 pi.dev can connect to SuperLocalMemory through the standard stdio MCP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superlocalmemory",
-  "version": "3.8.14",
+  "version": "4.0.0",
   "description": "Local-first agent memory with MCP and an agent-native CLI. Documented clients include Claude Code, Cursor, and Windsurf.",
   "keywords": [
     "ai-memory",
@@ -81,9 +81,14 @@
     "plugin/",
     "plugin-src/skills/slm-cache/SKILL.md",
     "plugin-src/skills/slm-compress/SKILL.md",
+    "plugin-src/skills/slm-governance/SKILL.md",
     "plugin-src/skills/slm-graph/SKILL.md",
+    "plugin-src/skills/slm-loop/SKILL.md",
+    "plugin-src/skills/slm-mesh/SKILL.md",
+    "plugin-src/skills/slm-profile/SKILL.md",
     "plugin-src/skills/slm-recall/SKILL.md",
     "plugin-src/skills/slm-remember/SKILL.md",
+    "plugin-src/skills/slm-scope/SKILL.md",
     "plugin-src/skills/slm-session/SKILL.md",
     "plugin-src/skills/slm-status/SKILL.md",
     "plugin-src/rules/AGENTS.md",

package/plugin/.claude-plugin/plugin.json

@@ -15,5 +15,5 @@
   "mcpServers": "./.mcp.json",
   "name": "superlocalmemory",
   "repository": "https://github.com/qualixar/superlocalmemory",
-  "version": "3.8.14"
+  "version": "4.0.0"
 }

package/plugin/CLAUDE.md

@@ -1,4 +1,4 @@
-<!-- BEGIN SuperLocalMemory v3.8.14 -->
+<!-- BEGIN SuperLocalMemory v4.0.0 -->
 
 ## SuperLocalMemory (SLM) — Agent Rules
 
@@ -39,6 +39,6 @@ slm-recall · slm-remember · slm-session · slm-status · slm-cache · slm-comp
 ### Subagents
 slm-memory-advisor (memory decisions, session hygiene, scope/profile guidance) · slm-optimize-advisor (context compression + KV cache) · slm-governance-advisor (scope/roles/compliance/GDPR)
 
-<!-- END SuperLocalMemory v3.8.14 -->
+<!-- END SuperLocalMemory v4.0.0 -->
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-governance-advisor.md

@@ -77,4 +77,4 @@ slm-scope · slm-governance · slm-profile · slm-remember · slm-recall
 # What NOT to do
 Never session_init twice; never forget without dry-run preview; never store secrets; never bypass role checks; never claim an erasure succeeded without verifying via recall.
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-loop-runner.md

@@ -68,4 +68,4 @@ assessment. The gate is the authority.
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-memory-advisor.md

@@ -46,4 +46,4 @@ slm-recall · slm-remember · slm-session · slm-scope · slm-profile · slm-gov
 # What NOT to do
 Never session_init twice; never forget dry_run=False without reporting preview; never dump a whole file into remember; never invent a memory; never claim "saved" without success:true / clean CLI exit; never bypass scope or governance restrictions.
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/agents/slm-optimize-advisor.md

@@ -41,4 +41,4 @@ slm-compress · slm-cache · slm-status · slm-profile
 # What NOT to do
 Never compress code-for-edit/JSON-to-parse/<500 chars; never store secrets/ccr_ids; never let optimize failure block/alter the task; never claim a specific savings %; never carry ccr_ids across profile switches.
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/requirements.txt

@@ -1 +1 @@
-superlocalmemory==3.8.14
+superlocalmemory==4.0.0

package/plugin/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-governance/SKILL.md

@@ -245,4 +245,4 @@ Before running any destructive operation (`forget`, `compact_memories`):
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-graph/SKILL.md

@@ -311,4 +311,4 @@ profile. See `slm-profile` for the full profile switching workflow.
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-loop/SKILL.md

@@ -96,4 +96,4 @@ paused, name the approval needed; when errored, quote the short detail.
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin/skills/slm-mesh/SKILL.md

@@ -279,4 +279,4 @@ mesh availability.
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-profile/SKILL.md

@@ -145,4 +145,4 @@ Name them differently in your MCP config (e.g. `superlocalmemory-personal` and
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-recall/SKILL.md

@@ -236,4 +236,4 @@ before recalling, then switch back. See `slm-profile` for workspace switching.
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-remember/SKILL.md

@@ -238,4 +238,4 @@ different workspace, use `switch_profile` first. See `slm-profile`.
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-scope/SKILL.md

@@ -173,4 +173,4 @@ to review the impact. See `slm-remember` for the full deletion discipline.
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-session/SKILL.md

@@ -227,4 +227,4 @@ explicitly and call `recall` with `include_global`/`include_shared` after
 
 ---
 
-*SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later*
+*SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later*

package/plugin/skills/slm-status/SKILL.md

@@ -163,4 +163,4 @@ multi-profile setup. To switch the active profile, see `slm-profile`.
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin-src/rules/AGENTS.md

@@ -128,4 +128,4 @@ When the SLM MCP server is unavailable, use these CLI equivalents:
 - **slm-optimize-advisor** — context compression and KV cache
 - **slm-governance-advisor** — scope/role compliance, retention policies, GDPR
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-cache/SKILL.md

@@ -145,4 +145,4 @@ These subcommands control daemon-level cache settings. They do not read or write
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later

package/plugin-src/skills/slm-compress/SKILL.md

@@ -147,4 +147,4 @@ Content over 1 MB (1 000 000 bytes UTF-8) is processed but `reversible` is force
 
 ---
 
-SuperLocalMemory v3.8.14 · Qualixar · AGPL-3.0-or-later
+SuperLocalMemory v4.0.0 · Qualixar · AGPL-3.0-or-later