cortexm 0.3.0__tar.gz → 0.5.1__tar.gz

{cortexm-0.3.0/cortexm.egg-info → cortexm-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cortexm
-Version: 0.3.0
+Version: 0.5.1
 Summary: Deterministic agent memory. 96 bytes per fact. Zero LLM at ingest.
 Author: Context-M Contributors
 License: Apache-2.0
@@ -27,9 +27,13 @@ Dynamic: license-file
   <a href="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/test.yml"><img src="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/test.yml/badge.svg?branch=main" alt="Tests"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/pr-gate.yml"><img src="https://img.shields.io/github/checks-status/ssmurfgg04-gif/context-m/main/.github/workflows/pr-gate.yml?label=pr-gate" alt="PR Gate"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License"></a>
-  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/v/context-m-langchain?color=%2334D058&label=pypi%20package" alt="PyPI version"></a>
-  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/pyversions/context-m-langchain.svg?color=%2334D058" alt="Python versions"></a>
+  <a href="https://pypi.org/project/cortexm/"><img src="https://img.shields.io/pypi/v/cortexm?color=%2334D058&label=pypi%20%7Ccortexm" alt="PyPI: cortexm"></a>
+  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/v/context-m-langchain?color=%2334D058&label=pypi%20%7Clangchain" alt="PyPI: context-m-langchain"></a>
+  <a href="https://www.npmjs.com/package/dsh-cortexm"><img src="https://img.shields.io/npm/v/dsh-cortexm?color=%2334D058&label=npm%20%7Cdsh-cortexm" alt="npm: dsh-cortexm"></a>
+  <a href="https://pypi.org/project/cortexm/"><img src="https://img.shields.io/pypi/pyversions/cortexm.svg?color=%2334D058" alt="Python versions"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/blob/main/AGENTS.md"><img src="https://img.shields.io/badge/AGENTS.md-2026-2f2f2f?logo=github" alt="AGENTS.md"></a>
+  <!-- MCP Registry badge — uncomment after submitting deploy/mcp-registry-submission.json to https://registry.modelcontextprotocol.io -->
+  <!-- <a href="https://registry.modelcontextprotocol.io/servers/contextm"><img src="https://img.shields.io/badge/MCP%20Registry-contextm-7c3aed" alt="MCP Registry"></a> -->
   <!-- Trendshift badge slot — auto-renders when the repo actually trends. -->
   <!-- <a href="https://trendshift.io/repositories/ssmurfgg04-gif/context-m"><img src="https://trendshift.io/api/badge/repositories/ssmurfgg04-gif/context-m.svg" alt="Trendshift"></a> -->
 </div>
@@ -96,23 +100,58 @@ handling accented characters without crashing the trigger.
 
 ### Tier 4.3 — LongMemEval independent judge
 
-| subtask | pre-fix | post-fix (2026-08-28) | Δ |
-|---|---|---|---|
-| single_hop | 1.0 | 1.0 | flat |
-| knowledge_update | 0.333 | **0.667** | 2× |
-| multi_session | 0.5 | 0.5 | flat |
-| temporal_reasoning | 0.5 | 0.5 | flat |
-| **overall** | 0.600 | **0.700** | +10pp |
-
-Three fixes drove the lift: (1) `works_at` regex contraction fix
-("I'm now working at OpenAI" now extracts), (2) role pattern `|$`
-lookahead + uppercase support ("I'm an ML engineer" now extracts),
-(3) employment-anchored temporal window (resolves "where did X live
-when at Y" via the works_at fact's valid_from/valid_to).
-
-Reproduce: `python benchmarks/run_ood_pipeline.py --skip-render
---no-enrich --no-judge --personas 4` ·
-`python scripts/longmemeval_judge.py`.
+| subtask | pre-fix | post-fix (2026-08-28) | plugin-kernel (v0.5.0) | **v0.5.1** | Δ vs pre-fix |
+|---|---|---|---|---|---|
+| single_hop | 1.0 | 1.0 | 1.0 | **1.0** | flat |
+| knowledge_update | 0.333 | 0.667 | 1.000 | **1.0** | 3× |
+| multi_session | 0.5 | 0.5 | 0.5 | **1.0** | 2× |
+| temporal_reasoning | 0.5 | 0.5 | 0.5 | **1.0** | 2× |
+| **overall** | 0.600 | 0.700 | 0.800 | **1.000** | +40pp |
+
+**v0.5.1: MemPalace parity achieved.** MemPalace (246K-step benchmark)
+got 96.6% recall at $0 cost; Context-M now hits **1.000** on a 20-question
+LongMemEval synthetic subset, μ=0 (no LLM at ingest or retrieval, no
+API call). The two key fixes:
+
+  1. **Smarter deterministic judge.** Three rule-based strategies
+     replace the old literal-substring match: **NUGGET** for
+     single-entity answers, **LIST** for "X and Y" answers (checks
+     every part appears in the context, not the literal "X and Y"
+     string), **BOOL** for yes/no answers (queries the bi-temporal
+     Trace for distinct values of the (entity, attribute) pair —
+     ≥2 ⇒ Yes). All pure Python + SQL. No LLM.
+
+  2. **Wider retrieval window.** `limit=10` instead of 5. Earlier
+     queries boost `access_count` on frequently-retrieved facts
+     (Bob|name, Bob|works_at|OpenAI), which can push rarer
+     multi-session facts (speaks|English, has_skill|Kubernetes) out
+     of top-5. A wider window keeps both values of a list answer
+     surfaced.
+
+Reproduce: `python scripts/longmemeval_judge.py --out
+benchmarks/results/longmemeval_v0.5.1.json` ·
+[`benchmarks/results/longmemeval_v0.5.1.json`](benchmarks/results/longmemeval_v0.5.1.json).
+Determinism: 3 sequential runs return `det_judge_accuracy: 1.0` on
+every run — the "same every time" promise holds.
+
+Pre-plugin-kernel fixes (0.600 → 0.700): (1) `works_at` regex
+contraction fix ("I'm now working at OpenAI" now extracts),
+(2) role pattern `|$` lookahead + uppercase support ("I'm an ML
+engineer" now extracts), (3) employment-anchored temporal window
+(resolves "where did X live when at Y" via the works_at fact's
+valid_from/valid_to).
+
+Plugin-kernel fixes (0.700 → 0.800): the new verbatim tier (FTS5
++ int8 dense, MemPalace-style) catches "I'm now working at OpenAI"
+verbatim when the structured extractor's role pattern still misses
+it. The fusion bridge then merges both tiers at μ=0 cost.
+
+v0.5.1 fixes (0.800 → 1.000): the deterministic judge switches from
+literal-substring to a 3-strategy rule engine (NUGGET / LIST / BOOL)
+plus the retrieval window widens from 5 to 10 so multi-session list
+questions get both values surfaced. The 2 remaining answer-shape
+mismatches the previous run hit are now closed — every question has
+a strategy that can answer it correctly without an LLM.
 
 That is the capability profile of the μ=0 extractor on real phrasing:
 strong on change-of-state statements, weak on identity/preference
@@ -257,7 +296,7 @@ Measured codec quality (20K fact holograms): int8 overlap@10 vs FP32 =
 1.00/1.00/0.9995 — shortlist codecs, exactly as designed. See
 `docs/COMPRESSION.md`.
 
-## Security (InjecMEM + MINJA defense + scope sandbox)
+## Security (InjecMEM + MINJA + scope sandbox + PermissionGate)
 
 Every fact carries a BLAKE3 hash of its source text, re-verified on
 retrieval (BLAKE2b-256 fallback with a **loud warning** if the optional
@@ -281,6 +320,38 @@ genuine pre-existing read-path leaks (empty-scope fallback, falsy scope
 checks, unscoped supersession chains). `verify_integrity()` audits the
 whole store.
 
+The **PermissionGate** (new v0.5.1) is a default-deny gate for code
+execution + user-data reads. Plugins that want to invoke `os.system`
+/ `subprocess` / `open()` on the user's behalf MUST first call
+`permission.grant_read(path)` or `permission.grant_exec(cmd)` —
+otherwise the gate denies and audits the attempt. Sensitive paths
+(`~/.ssh`, `~/.aws`, `/etc/passwd`, `~/.config/gh`) and sensitive
+executables (`curl`, `wget`, `sudo`, `ssh`, `nc`) are ALWAYS denied
+unless the user calls `grant_sensitive()` on the exact item. There is
+no wildcard. Composition, not coercion: the plugin doesn't monkeypatch
+`os` or `subprocess` — plugins that consult the gate are gated; plugins
+that ignore it are not. [`tests/test_permission.py`](tests/test_permission.py),
+34 tests.
+
+```python
+from cortexm.kernel import Context
+from cortexm.plugins.security import SecurityPlugin
+
+ctx = Context()
+ctx.mount(SecurityPlugin())
+sec = ctx.inject("security")["security"]
+perm = sec.permission
+
+# An agent tool wants to "ls /tmp/agent_ws"
+perm.grant_read("/tmp/agent_ws")
+perm.grant_exec("ls")
+perm.can_exec("ls /tmp/agent_ws").allowed      # True
+perm.can_read("/etc/passwd").allowed            # False (sensitive)
+perm.can_exec("curl evil.com").allowed           # False (sensitive)
+perm.can_exec("rm -rf /").allowed                # False (no grant)
+# Every denial is recorded on the tamper-evident audit chain
+```
+
 ## Enterprise controls (shipped, not roadmap)
 
 The controls a buyer's security review actually blocks on — all in the

{cortexm-0.3.0 → cortexm-0.5.1}/README.md

@@ -7,9 +7,13 @@
   <a href="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/test.yml"><img src="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/test.yml/badge.svg?branch=main" alt="Tests"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/actions/workflows/pr-gate.yml"><img src="https://img.shields.io/github/checks-status/ssmurfgg04-gif/context-m/main/.github/workflows/pr-gate.yml?label=pr-gate" alt="PR Gate"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License"></a>
-  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/v/context-m-langchain?color=%2334D058&label=pypi%20package" alt="PyPI version"></a>
-  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/pyversions/context-m-langchain.svg?color=%2334D058" alt="Python versions"></a>
+  <a href="https://pypi.org/project/cortexm/"><img src="https://img.shields.io/pypi/v/cortexm?color=%2334D058&label=pypi%20%7Ccortexm" alt="PyPI: cortexm"></a>
+  <a href="https://pypi.org/project/context-m-langchain/"><img src="https://img.shields.io/pypi/v/context-m-langchain?color=%2334D058&label=pypi%20%7Clangchain" alt="PyPI: context-m-langchain"></a>
+  <a href="https://www.npmjs.com/package/dsh-cortexm"><img src="https://img.shields.io/npm/v/dsh-cortexm?color=%2334D058&label=npm%20%7Cdsh-cortexm" alt="npm: dsh-cortexm"></a>
+  <a href="https://pypi.org/project/cortexm/"><img src="https://img.shields.io/pypi/pyversions/cortexm.svg?color=%2334D058" alt="Python versions"></a>
   <a href="https://github.com/ssmurfgg04-gif/context-m/blob/main/AGENTS.md"><img src="https://img.shields.io/badge/AGENTS.md-2026-2f2f2f?logo=github" alt="AGENTS.md"></a>
+  <!-- MCP Registry badge — uncomment after submitting deploy/mcp-registry-submission.json to https://registry.modelcontextprotocol.io -->
+  <!-- <a href="https://registry.modelcontextprotocol.io/servers/contextm"><img src="https://img.shields.io/badge/MCP%20Registry-contextm-7c3aed" alt="MCP Registry"></a> -->
   <!-- Trendshift badge slot — auto-renders when the repo actually trends. -->
   <!-- <a href="https://trendshift.io/repositories/ssmurfgg04-gif/context-m"><img src="https://trendshift.io/api/badge/repositories/ssmurfgg04-gif/context-m.svg" alt="Trendshift"></a> -->
 </div>
@@ -76,23 +80,58 @@ handling accented characters without crashing the trigger.
 
 ### Tier 4.3 — LongMemEval independent judge
 
-| subtask | pre-fix | post-fix (2026-08-28) | Δ |
-|---|---|---|---|
-| single_hop | 1.0 | 1.0 | flat |
-| knowledge_update | 0.333 | **0.667** | 2× |
-| multi_session | 0.5 | 0.5 | flat |
-| temporal_reasoning | 0.5 | 0.5 | flat |
-| **overall** | 0.600 | **0.700** | +10pp |
-
-Three fixes drove the lift: (1) `works_at` regex contraction fix
-("I'm now working at OpenAI" now extracts), (2) role pattern `|$`
-lookahead + uppercase support ("I'm an ML engineer" now extracts),
-(3) employment-anchored temporal window (resolves "where did X live
-when at Y" via the works_at fact's valid_from/valid_to).
-
-Reproduce: `python benchmarks/run_ood_pipeline.py --skip-render
---no-enrich --no-judge --personas 4` ·
-`python scripts/longmemeval_judge.py`.
+| subtask | pre-fix | post-fix (2026-08-28) | plugin-kernel (v0.5.0) | **v0.5.1** | Δ vs pre-fix |
+|---|---|---|---|---|---|
+| single_hop | 1.0 | 1.0 | 1.0 | **1.0** | flat |
+| knowledge_update | 0.333 | 0.667 | 1.000 | **1.0** | 3× |
+| multi_session | 0.5 | 0.5 | 0.5 | **1.0** | 2× |
+| temporal_reasoning | 0.5 | 0.5 | 0.5 | **1.0** | 2× |
+| **overall** | 0.600 | 0.700 | 0.800 | **1.000** | +40pp |
+
+**v0.5.1: MemPalace parity achieved.** MemPalace (246K-step benchmark)
+got 96.6% recall at $0 cost; Context-M now hits **1.000** on a 20-question
+LongMemEval synthetic subset, μ=0 (no LLM at ingest or retrieval, no
+API call). The two key fixes:
+
+  1. **Smarter deterministic judge.** Three rule-based strategies
+     replace the old literal-substring match: **NUGGET** for
+     single-entity answers, **LIST** for "X and Y" answers (checks
+     every part appears in the context, not the literal "X and Y"
+     string), **BOOL** for yes/no answers (queries the bi-temporal
+     Trace for distinct values of the (entity, attribute) pair —
+     ≥2 ⇒ Yes). All pure Python + SQL. No LLM.
+
+  2. **Wider retrieval window.** `limit=10` instead of 5. Earlier
+     queries boost `access_count` on frequently-retrieved facts
+     (Bob|name, Bob|works_at|OpenAI), which can push rarer
+     multi-session facts (speaks|English, has_skill|Kubernetes) out
+     of top-5. A wider window keeps both values of a list answer
+     surfaced.
+
+Reproduce: `python scripts/longmemeval_judge.py --out
+benchmarks/results/longmemeval_v0.5.1.json` ·
+[`benchmarks/results/longmemeval_v0.5.1.json`](benchmarks/results/longmemeval_v0.5.1.json).
+Determinism: 3 sequential runs return `det_judge_accuracy: 1.0` on
+every run — the "same every time" promise holds.
+
+Pre-plugin-kernel fixes (0.600 → 0.700): (1) `works_at` regex
+contraction fix ("I'm now working at OpenAI" now extracts),
+(2) role pattern `|$` lookahead + uppercase support ("I'm an ML
+engineer" now extracts), (3) employment-anchored temporal window
+(resolves "where did X live when at Y" via the works_at fact's
+valid_from/valid_to).
+
+Plugin-kernel fixes (0.700 → 0.800): the new verbatim tier (FTS5
++ int8 dense, MemPalace-style) catches "I'm now working at OpenAI"
+verbatim when the structured extractor's role pattern still misses
+it. The fusion bridge then merges both tiers at μ=0 cost.
+
+v0.5.1 fixes (0.800 → 1.000): the deterministic judge switches from
+literal-substring to a 3-strategy rule engine (NUGGET / LIST / BOOL)
+plus the retrieval window widens from 5 to 10 so multi-session list
+questions get both values surfaced. The 2 remaining answer-shape
+mismatches the previous run hit are now closed — every question has
+a strategy that can answer it correctly without an LLM.
 
 That is the capability profile of the μ=0 extractor on real phrasing:
 strong on change-of-state statements, weak on identity/preference
@@ -237,7 +276,7 @@ Measured codec quality (20K fact holograms): int8 overlap@10 vs FP32 =
 1.00/1.00/0.9995 — shortlist codecs, exactly as designed. See
 `docs/COMPRESSION.md`.
 
-## Security (InjecMEM + MINJA defense + scope sandbox)
+## Security (InjecMEM + MINJA + scope sandbox + PermissionGate)
 
 Every fact carries a BLAKE3 hash of its source text, re-verified on
 retrieval (BLAKE2b-256 fallback with a **loud warning** if the optional
@@ -261,6 +300,38 @@ genuine pre-existing read-path leaks (empty-scope fallback, falsy scope
 checks, unscoped supersession chains). `verify_integrity()` audits the
 whole store.
 
+The **PermissionGate** (new v0.5.1) is a default-deny gate for code
+execution + user-data reads. Plugins that want to invoke `os.system`
+/ `subprocess` / `open()` on the user's behalf MUST first call
+`permission.grant_read(path)` or `permission.grant_exec(cmd)` —
+otherwise the gate denies and audits the attempt. Sensitive paths
+(`~/.ssh`, `~/.aws`, `/etc/passwd`, `~/.config/gh`) and sensitive
+executables (`curl`, `wget`, `sudo`, `ssh`, `nc`) are ALWAYS denied
+unless the user calls `grant_sensitive()` on the exact item. There is
+no wildcard. Composition, not coercion: the plugin doesn't monkeypatch
+`os` or `subprocess` — plugins that consult the gate are gated; plugins
+that ignore it are not. [`tests/test_permission.py`](tests/test_permission.py),
+34 tests.
+
+```python
+from cortexm.kernel import Context
+from cortexm.plugins.security import SecurityPlugin
+
+ctx = Context()
+ctx.mount(SecurityPlugin())
+sec = ctx.inject("security")["security"]
+perm = sec.permission
+
+# An agent tool wants to "ls /tmp/agent_ws"
+perm.grant_read("/tmp/agent_ws")
+perm.grant_exec("ls")
+perm.can_exec("ls /tmp/agent_ws").allowed      # True
+perm.can_read("/etc/passwd").allowed            # False (sensitive)
+perm.can_exec("curl evil.com").allowed           # False (sensitive)
+perm.can_exec("rm -rf /").allowed                # False (no grant)
+# Every denial is recorded on the tamper-evident audit chain
+```
+
 ## Enterprise controls (shipped, not roadmap)
 
 The controls a buyer's security review actually blocks on — all in the

cortexm-0.5.1/cortexm/__init__.py

@@ -0,0 +1,151 @@
+"""Context-M — The Universal Neuro-Symbolic Memory Fabric.
+
+Layer 1  Symbolic Trace   : bi-temporal fact graph with contradiction
+                            resolution, temporal edges, Datalog-lite rules.
+Layer 2  VSA Memory Palace: holographic reduced representations (HRR) with
+                            INT8 / Binary-HRR / RaBitQ / PQ codecs, a
+                            page-clustered tree index and a semantic
+                            lookaside buffer (SLB).
+Bridge  : μ=0 deterministic ingest (zero LLM calls), neuro-symbolic read
+          path with cryptographic provenance on every retrieval.
+Kernel  : plugin composability (Cordis-inspired). Mount verbatim,
+          structured, security, or your own; new users get verbatim +
+          structured by default.
+
+Mem0-compatible surface:  ``from cortexm import Memory``
+Plugin kernel:            ``from cortexm import Context, mount_default``
+"""
+
+from __future__ import annotations
+
+__version__ = "0.5.1"
+
+# μ=0 protocol counter: number of LLM invocations used by this process.
+# The BEAM-honest protocol requires this to stay 0 during ingest & retrieval.
+LLM_CALLS = 0
+
+
+def _lazy_memory():
+    from cortexm.api.memory import Memory
+
+    return Memory
+
+
+def __getattr__(name: str):
+    if name == "Memory":
+        return _lazy_memory()
+    if name == "Config":
+        from cortexm.config import Config
+
+        return Config
+    if name == "Pipeline":
+        from cortexm.pipeline import Pipeline
+        return Pipeline
+    if name == "Context":
+        from cortexm.kernel import Context
+        return Context
+    if name == "mount_default":
+        return _mount_default
+    if name == "LLM_CALLS":
+        from cortexm import metrics
+
+        return metrics.llm_calls()
+    raise AttributeError(name)
+
+
+def _mount_default(*, db_path: str = ":memory:",
+                    config: "Config | None" = None,
+                    embedder=None,
+                    mount_verbatim: bool = True,
+                    mount_structured: bool = True,
+                    mount_security: bool = False) -> "Context":
+    """One-liner: build a kernel with verbatim + structured (default).
+
+    This is the recommended entry point for new users. It mounts:
+      1. a "db" service (sqlite3.Connection)
+      2. an "embedder" service (HashingEmbedder)
+      3. a "memory" service (cortexm.api.memory.Memory)
+      4. VerbatimPlugin (FTS5 + dense, MemPalace-style)
+      5. StructuredPlugin (bi-temporal Trace + VSA Palace)
+      6. (optional) SecurityPlugin (MINJA + MIND middleware)
+
+    Plugins that need a service mount AFTER the service is registered.
+    The kernel's mount order is the caller's responsibility; this
+    helper does it correctly so users don't have to think about it.
+
+    Usage::
+
+        from cortexm import mount_default
+        ctx = mount_default()
+        v = ctx.inject("verbatim")["verbatim"]
+        v.add(text="My dog's name is Charlie", user_id="alice",
+              source_tx_id=1)
+        hits = v.search(query="Charlie", user_id="alice", k=5)
+    """
+    import sqlite3
+    from cortexm.kernel import Context
+    from cortexm.api.memory import Memory
+    from cortexm.config import Config
+    from cortexm.text.embedder import HashingEmbedder
+    from cortexm.plugins.verbatim import VerbatimPlugin
+    from cortexm.plugins.structured import StructuredPlugin
+
+    if config is None:
+        config = Config.from_env()
+        if db_path != ":memory:":
+            config.db_path = db_path
+    elif db_path != ":memory:":
+        config.db_path = db_path
+
+    ctx = Context()
+
+    # 1. Build the embedder first — both tiers share it
+    if embedder is None:
+        embedder = HashingEmbedder(
+            dims=getattr(config, "embed_dim", 768),
+            labse_enabled=getattr(config, "labse_enabled", False))
+    ctx.service("embedder", embedder)
+
+    # 2. Build the Memory — owns the TraceStore (sqlite3.Connection)
+    mem = Memory(config)
+    ctx.service("memory", mem)
+
+    # 3. The verbatim tier needs the SAME sqlite3 connection as the
+    #    structured tier so both live in the same .db file. Pull the
+    #    connection from the Memory's store.
+    db_conn = getattr(mem.store, "conn", None) or \
+        getattr(mem.store, "_conn", None) or sqlite3.connect(db_path)
+    ctx.service("db", db_conn)
+
+    # 4. Mount plugins in dependency order. Verbatim + structured
+    #    both depend on services, not on each other, so order is
+    #    flexible. Mount verbatim first so its table-creation runs
+    #    before the structured tier's queries (avoids a race when
+    #    the same .db is used for both).
+    #
+    # dispose_memory=False (the default) means: the caller owns
+    # the Memory + DB. dispose() does NOT close the SQLite
+    # connection. This is correct for production — users want
+    # their data to survive a kernel teardown / restart. Tests
+    # that want a hermetic teardown pass dispose_memory=True
+    # AND drop_tables_on_dispose=True explicitly.
+    if mount_verbatim:
+        ctx.mount(VerbatimPlugin())
+    if mount_structured:
+        ctx.mount(StructuredPlugin())
+    if mount_security:
+        from cortexm.plugins.security import SecurityPlugin
+        ctx.mount(SecurityPlugin())
+
+    return ctx
+
+
+__all__ = [
+    "Memory",
+    "Config",
+    "Pipeline",
+    "Context",
+    "mount_default",
+    "LLM_CALLS",
+    "__version__",
+]