curu-memory 0.2.0__tar.gz

curu_memory-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.pyc
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.coverage
+.env
+.env.*
+.DS_Store
+*.swp
+.vscode/
+.idea/

curu_memory-0.2.0/CHANGELOG.md

@@ -0,0 +1,78 @@
+# Changelog
+
+All notable changes to this project are in this file. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). The project uses [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.2.0] - 2026-11-01
+
+This is the first release on PyPI. Version 0.1.0 was not published.
+
+### Added
+
+- The CI workflow runs the quality gates on each pull request and each push to `main`, in the job `Quality gates`.
+- The release workflow: a tag `vX.Y.Z` on `main` starts it. It checks the tag, the CI result, the version and the changelog section. Then it makes the GitHub Release and uploads to PyPI with trusted publishing.
+- ADR-019: curu uses curu-memory as a library, through the names in `__all__` only. It maps curu's retrieval ports and scopes, and it gives the version policy below 1.0.
+- Agents with grants: `curu-memory access agent add|remove`, `access grant` and `access revoke`. An agent reads only the spaces of its live grants, and never more than its person.
+- `CURU_MEMORY_OIDC_BASIC_CLIENT_ID`: an agent can send the app password of its Authentik service account, and curu-memory exchanges it for a token.
+- `curu-memory serve --grant ID`: a stdio process acts as the agent of one grant.
+- The key `acts_for` in each audit line.
+- OIDC tokens on HTTP: `CURU_MEMORY_OIDC_ISSUER`, `CURU_MEMORY_OIDC_RESOURCE`, `CURU_MEMORY_OIDC_AUDIENCE` and `CURU_MEMORY_OIDC_TOKEN_TYPES`. The server publishes the metadata of RFC 9728, and finds the person of each token by its issuer and subject. The settings for Authentik are in the README.
+- `curu-memory access person add --issuer --subject` and `curu-memory access person link`.
+- With `CURU_MEMORY_OIDC_ISSUER`, `serve` ignores `CURU_MEMORY_HTTP_TOKEN`. The static token stays the basic mode with no OIDC provider.
+- `deploy/rauthy/`: rauthy 0.37.2 in Docker Compose, with `init.sh` and `setup.sh`.
+- Persons and teams: `curu-memory access person|team|member add|remove` and `curu-memory access show`. `CURU_MEMORY_PRINCIPAL` names the person of `serve`, `browse` and `search`. A person reads only the spaces of their roles, and only that person reads their personal space.
+- The audit log `audit.jsonl`: one line for each change of access and each refused read, with no secret and no content.
+- The error `access_refused` for a caller that can read no space.
+- Team spaces and personal spaces: `curu-memory index --space team/<slug>` or `--space personal/<handle>`. Each space has its own index file. Each search result and `get_concept` give the `space` of the concept.
+- The index command holds a lock, refuses a second embedder model, and skips a concept whose identifier is in another space.
+
+- A search with a video: `search_knowledge_by_media` and `curu-memory search --media` take MP4, MOV, WebM and MKV. `CURU_MEMORY_EMBEDDER_MIN_VIDEO_TO_VIDEO_SIMILARITY` and `CURU_MEMORY_EMBEDDER_MIN_VIDEO_TO_TEXT_SIMILARITY` set the limits.
+- Video in concepts. The `media` list accepts MP4, MOV, WebM and MKV files of 10 MB or less. Words find a video by meaning, `matched_kind` is `video`, and the browser plays each video. `CURU_MEMORY_EMBEDDER_MIN_VIDEO_SIMILARITY` sets the limit.
+- The development embedder embeds video items, at most 32 frames of each.
+- Audio in concepts. The `media` list accepts WAV, FLAC, MP3 and Ogg clips of 10 MB or less. Words find a clip by meaning, `matched_kind` is `audio`, and the browser plays each clip. `CURU_MEMORY_EMBEDDER_MIN_AUDIO_SIMILARITY` sets the limit.
+- The development embedder embeds audio items. It decodes at most 300 seconds of each clip.
+- The browser answers a Range request for a media file, so a web browser can play a clip and seek in it.
+- A search with media: the MCP tool `search_knowledge_by_media` and `curu-memory search --media <file>`. The file is an image or an audio clip, and the kind comes from the bytes. Four new settings set the limits: `CURU_MEMORY_EMBEDDER_MIN_IMAGE_TO_IMAGE_SIMILARITY`, `CURU_MEMORY_EMBEDDER_MIN_IMAGE_TO_TEXT_SIMILARITY`, `CURU_MEMORY_EMBEDDER_MIN_AUDIO_TO_AUDIO_SIMILARITY` and `CURU_MEMORY_EMBEDDER_MIN_AUDIO_TO_TEXT_SIMILARITY`.
+- The printed search result gives the matched unit of each concept.
+- The browser shows the images of a concept, and serves each image at `/media/<sha256>`.
+- `get_concept` gives a `media` list with the path, the SHA-256 and the MIME type of each image.
+- Images in concepts. A front-matter list `media` names PNG, JPEG and WebP files of 10 MB or less. The index command embeds each image in the same space as the text, so a question in words can find it. The report gives a warning for each image that is not in the index.
+- `matched_kind` in each search result: `text`, `image` or `audio`.
+- `CURU_MEMORY_EMBEDDER_MIN_IMAGE_SIMILARITY`: the lowest similarity that counts as a match between a question and an image.
+- The development embedder embeds image items.
+- `CURU_MEMORY_EMBEDDER_MIN_SIMILARITY`: the lowest similarity that counts as a match of meaning. The default is 0.68 for EmbeddingGemma 2, from a measurement, and 0.35 for other models.
+- `tools/embedder_server/`: a development embedder that serves EmbeddingGemma 2 on the CPU, for the integration tier.
+
+- The `curu-memory browse` command: a read-only web browser to search the knowledge and follow the links of a concept. It needs the HTTP token on an address that is not loopback.
+
+- EmbeddingGemma 2 (`google/embeddinggemma-2`) is the default embedding model when `CURU_MEMORY_EMBEDDER_URL` is set. `CURU_MEMORY_EMBEDDER_MODEL` overrides it.
+- The task prompts of EmbeddingGemma for questions and documents. `CURU_MEMORY_EMBEDDER_QUERY_PROMPT` and `CURU_MEMORY_EMBEDDER_DOCUMENT_PROMPT` override them.
+- The index records its prompts. A search with other prompts uses words only and says why.
+
+### Changed
+
+- The source distribution holds only `src/`, `tests/`, `README.md`, `LICENSE`, `CHANGELOG.md` and `pyproject.toml`.
+- The default port of `serve --transport http` is 6474, and the default port of `browse` is 6475. Before, they were 8000 and 8001, which many other servers use.
+- Without `CURU_MEMORY_PRINCIPAL`, `serve`, `browse` and `search` read `global` only. Register a person and set the principal to read team and personal spaces.
+- `concept_neighbours` resolves a link when it reads, over the readable spaces. A link to a concept in another readable space now has `resolved: true`.
+- The `Retriever` takes the readable spaces on each call, not when it is made.
+- The index report gives `media embedded` and `media skipped` in place of `images embedded` and `images skipped`.
+- The `Embedder` port method `embed_images` is now `embed_media`, for images and audio.
+- The streamable HTTP transport accepts a request body of up to 16 MiB. An image of 10 MB can then reach the tool as base64. The SDK default was 4 MiB.
+- The index has schema version 3. It holds each accepted image of a concept and one copy of its bytes, also when the embedder does not embed it. An index of version 1 or 2 still works, with no images.
+- A `## Summary` heading now has the slug `summary-2`, and a numbered heading skips each slug that the concept already uses. Before, such a heading stopped the index run.
+- The index has schema version 2: each unit has a kind, and an image unit has its path and its SHA-256. An index of version 1 still works.
+- Rank fusion damps the second value of a concept to one tenth. The best answer of one ranking then stays in the results. The highest score is now about 0.018.
+- With EmbeddingGemma 2, an unrelated question now finds nothing by meaning. A common word in the question can still match by words. Before, each concept passed the old limit of 0.35.
+- `CURU_MEMORY_EMBEDDER_URL` no longer needs `CURU_MEMORY_EMBEDDER_MODEL`.
+
+## [0.1.0]
+
+### Added
+
+- The `curu-memory index` command. It reads a directory of OKF concept files, validates them with the rules of the curu index, and builds one deterministic index. It reports each skipped file, each warning and each broken link.
+- The `curu-memory search` command. It searches by words, and by meaning when an OpenAI-compatible embedder is set.
+- The `curu-memory serve` command. It serves the read-only MCP tools `search_knowledge`, `get_concept` and `concept_neighbours` on stdio or on streamable HTTP.
+- A static bearer token for the HTTP transport. The server does not start on HTTP without a token of 32 characters or more.
+- Typed tool errors: `index_missing`, `concept_not_found` and `invalid_argument`.

curu_memory-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 James Veitch
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.