holographic-memory-py 0.6.3__tar.gz

holographic_memory_py-0.6.3/.bestpractices.json

@@ -0,0 +1,260 @@
+{
+  "description_good_status": "Met",
+  "description_good_justification": "README.md opens with the project description: privacy-preserving semantic search and associative memory that runs entirely on the user's machine.",
+  "interact_status": "Met",
+  "interact_justification": "README.md has Installation and Quick Start sections; CONTRIBUTING.md and the issue forms in .github/ISSUE_TEMPLATE/ explain how to give feedback and contribute.",
+  "contribution_status": "Met",
+  "contribution_justification": "CONTRIBUTING.md 'Pull Requests' and 'Developer Certificate of Origin' describe the process; .github/pull_request_template.md is the checklist.",
+  "contribution_requirements_status": "Met",
+  "contribution_requirements_justification": "CONTRIBUTING.md 'Testing Policy' and 'Style Guidelines' (rustfmt, clippy -D warnings, commit format) and the DCO sign-off requirement.",
+  "floss_license_status": "Met",
+  "floss_license_justification": "Apache-2.0: LICENSE at the repository root; Cargo.toml and package.json declare it.",
+  "floss_license_osi_status": "Met",
+  "floss_license_osi_justification": "Apache-2.0 is OSI-approved.",
+  "license_location_status": "Met",
+  "license_location_justification": "LICENSE at the repository root.",
+  "documentation_basics_status": "Met",
+  "documentation_basics_justification": "README.md plus docs/ARCHITECTURE.md, docs/INTEGRATION.md, docs/production-readiness.md, docs/SERVER.md.",
+  "documentation_interface_status": "Met",
+  "documentation_interface_justification": "index.d.ts (Node API), docs.rs for the Rust API, docs/SERVER.md for the HTTP interface, bindings/python/holographic-sdk/README.md for the SDK.",
+  "sites_https_status": "Met",
+  "sites_https_justification": "https://github.com/writerslogic/holographic-memory, crates.io, npmjs.com, pypi.org, docs.rs and the project site are all served over HTTPS.",
+  "discussion_status": "Met",
+  "discussion_justification": "GitHub issues and pull requests (https://github.com/writerslogic/holographic-memory/issues) are searchable, URL-addressable and need no proprietary client.",
+  "english_status": "Met",
+  "english_justification": "Documentation, issues and commit messages are in English.",
+  "maintained_status": "Met",
+  "maintained_justification": "Active development: hundreds of commits through October 2026 and a Scorecard 'Maintained' score of 10.",
+  "repo_public_status": "Met",
+  "repo_public_justification": "https://github.com/writerslogic/holographic-memory is public.",
+  "repo_track_status": "Met",
+  "repo_track_justification": "Git records author, date and diff for every change.",
+  "repo_interim_status": "Met",
+  "repo_interim_justification": "Work lands as many commits and pull requests between tagged releases, not only at release time.",
+  "repo_distributed_status": "Met",
+  "repo_distributed_justification": "Git.",
+  "version_unique_status": "Met",
+  "version_unique_justification": "scripts/ci/check-versions.py fails the build unless Cargo.toml, package.json and its optionalDependencies agree on one version, and a release tag names it.",
+  "version_semver_status": "Met",
+  "version_semver_justification": "SemVer (0.6.1); scripts/ci/bump-version.py accepts only X.Y.Z[-pre].",
+  "version_tags_status": "Met",
+  "version_tags_justification": "Git tags v0.6.1 and py-v0.6.1; release.yml and publish-pypi.yml are triggered by v* and py-v* tags.",
+  "release_notes_status": "Met",
+  "release_notes_justification": "CHANGELOG.md has a section per release grouped by type, generated by git-cliff (cliff.toml) from conventional commits; docs/RELEASING.md step 5 has the maintainer write the GitHub release notes by hand before publishing the draft.",
+  "release_notes_vulns_status": "N/A",
+  "release_notes_vulns_justification": "No publicly known vulnerability has been fixed in a release.",
+  "report_process_status": "Met",
+  "report_process_justification": "CONTRIBUTING.md 'Reporting Bugs' and the bug_report.yml issue form.",
+  "report_tracker_status": "Met",
+  "report_tracker_justification": "GitHub issues: https://github.com/writerslogic/holographic-memory/issues.",
+  "report_responses_status": "?",
+  "report_responses_justification": "Few reports come from outside the maintainer; the response rate over the last 12 months has not been audited.",
+  "enhancement_responses_status": "?",
+  "enhancement_responses_justification": "Enhancement requests are tracked as issues (e.g. #40-#51) but the response rate to outside requests has not been audited.",
+  "report_archive_status": "Met",
+  "report_archive_justification": "GitHub keeps all issues and comments publicly and searchably.",
+  "vulnerability_report_process_status": "Met",
+  "vulnerability_report_process_justification": "SECURITY.md 'Reporting a Vulnerability'.",
+  "vulnerability_report_private_status": "Met",
+  "vulnerability_report_private_justification": "GitHub private vulnerability reporting is enabled for the repository and SECURITY.md names an e-mail address.",
+  "vulnerability_report_response_status": "Met",
+  "vulnerability_report_response_justification": "SECURITY.md promises an initial response within a few days, inside the 14-day limit.",
+  "build_status": "Met",
+  "build_justification": "cargo build; npm run build (napi-rs); maturin build for the wheels, all documented in CONTRIBUTING.md and docs/RELEASING.md.",
+  "build_common_tools_status": "Met",
+  "build_common_tools_justification": "cargo, npm and maturin.",
+  "build_floss_tools_status": "Met",
+  "build_floss_tools_justification": "All build tools are FLOSS.",
+  "test_status": "Met",
+  "test_justification": "Rust unit and integration tests (cargo test / cargo nextest), Node tests (tests/node), SDK tests against a live hms-server; run by .github/workflows/ci.yml.",
+  "test_invocation_status": "Met",
+  "test_invocation_justification": "`cargo test`, `npm test`, documented in CONTRIBUTING.md.",
+  "test_most_status": "Met",
+  "test_most_justification": "Line coverage of the library is 86.3% (.github/workflows/coverage.yml, .github/badges/coverage.json).",
+  "test_continuous_integration_status": "Met",
+  "test_continuous_integration_justification": ".github/workflows/ci.yml runs on every pull request and push to main.",
+  "test_policy_status": "Met",
+  "test_policy_justification": "CONTRIBUTING.md 'Testing Policy' requires a test for new functionality.",
+  "tests_are_added_status": "Met",
+  "tests_are_added_justification": "Recent feature and fix pull requests (e.g. the Windows compaction fix, #112) add tests with the change.",
+  "tests_documented_added_status": "Met",
+  "tests_documented_added_justification": "CONTRIBUTING.md 'Testing Policy' and the checklist in .github/pull_request_template.md.",
+  "warnings_status": "Met",
+  "warnings_justification": "rustc and clippy warnings are enabled.",
+  "warnings_fixed_status": "Met",
+  "warnings_fixed_justification": "ci.yml fails on any warning (clippy -D warnings), so none are merged.",
+  "warnings_strict_status": "Met",
+  "warnings_strict_justification": "`cargo clippy --all-targets [--all-features] -- -D warnings` on the newest stable clippy, plus one clippy job per feature (ci.yml).",
+  "know_secure_design_status": "?",
+  "know_secure_design_justification": "docs/SECURITY.md records the threat model, trust boundaries and design choices, but the maintainer has not attested to this criterion for the form.",
+  "know_common_errors_status": "?",
+  "know_common_errors_justification": "CodeQL, clippy and the fuzz targets target common error classes, but the maintainer has not attested to this criterion for the form.",
+  "crypto_published_status": "Met",
+  "crypto_published_justification": "Ed25519, AES-256-GCM, Argon2 and SHA-2, via published RustCrypto implementations (docs/SECURITY.md 'Cryptographic Choices').",
+  "crypto_call_status": "Met",
+  "crypto_call_justification": "Cryptography comes from the ed25519-dalek, aes-gcm, argon2 and sha2 crates; nothing is reimplemented.",
+  "crypto_floss_status": "Met",
+  "crypto_floss_justification": "All of those crates are FLOSS.",
+  "crypto_keylength_status": "Met",
+  "crypto_keylength_justification": "AES-256 and Ed25519 (about 128-bit security).",
+  "crypto_working_status": "Met",
+  "crypto_working_justification": "No broken algorithm is used for security purposes (CRC32 is an integrity checksum only, not a security control).",
+  "crypto_weaknesses_status": "Met",
+  "crypto_weaknesses_justification": "No MD5, SHA-1, DES or similar; docs/SECURITY.md 'Cryptographic Choices'.",
+  "crypto_pfs_status": "N/A",
+  "crypto_pfs_justification": "HMS implements no key-agreement protocol.",
+  "crypto_password_storage_status": "N/A",
+  "crypto_password_storage_justification": "HMS stores no passwords to authenticate users; passphrases only derive encryption keys with Argon2 (docs/SECURITY.md) and the server API key is compared in constant time (src/bin/hms-server.rs).",
+  "crypto_random_status": "Met",
+  "crypto_random_justification": "Salts and nonces come from rand::rng(), an OS-seeded CSPRNG (src/core/security.rs).",
+  "delivery_mitm_status": "Met",
+  "delivery_mitm_justification": "Releases are distributed through GitHub, crates.io, npm and PyPI over HTTPS.",
+  "delivery_unsigned_status": "Met",
+  "delivery_unsigned_justification": "No checksum or signature is fetched over an unauthenticated channel; SHA256SUMS and attestations are release assets.",
+  "vulnerabilities_fixed_60_days_status": "Met",
+  "vulnerabilities_fixed_60_days_justification": "Zero open Dependabot and code-scanning alerts; cargo-deny (ci.yml) fails on advisories, and the six documented ignores in deny.toml are unmaintained-crate notices or functions that are never called.",
+  "vulnerabilities_critical_fixed_status": "Met",
+  "vulnerabilities_critical_fixed_justification": "No known critical vulnerability is open.",
+  "no_leaked_credentials_status": "Met",
+  "no_leaked_credentials_justification": "GitHub secret scanning and push protection are enabled; no credentials are in the repository.",
+  "static_analysis_status": "Met",
+  "static_analysis_justification": "CodeQL (Rust, JavaScript, Python, Actions) and clippy on every pull request; actionlint and zizmor on every workflow (ci.yml 'workflows').",
+  "static_analysis_common_vulnerabilities_status": "Met",
+  "static_analysis_common_vulnerabilities_justification": "CodeQL's security queries and zizmor.",
+  "static_analysis_fixed_status": "Met",
+  "static_analysis_fixed_justification": "Code scanning shows no open alert; findings block merges through review threads.",
+  "static_analysis_often_status": "Met",
+  "static_analysis_often_justification": "On every pull request and push to main.",
+  "dynamic_analysis_status": "Met",
+  "dynamic_analysis_justification": "cargo-fuzz targets for every untrusted-input parser, run for a short time on every pull request touching fuzzed code and for longer on a schedule (.github/workflows/fuzz.yml, fuzz/); property tests (src/lib_proptest.rs).",
+  "dynamic_analysis_unsafe_status": "Met",
+  "dynamic_analysis_unsafe_justification": "Rust is memory safe apart from a few audited `unsafe` blocks (memory mapping); the fuzz targets run under AddressSanitizer (cargo-fuzz default).",
+  "dynamic_analysis_enable_assertions_status": "Met",
+  "dynamic_analysis_enable_assertions_justification": "Tests and fuzz builds keep debug assertions enabled.",
+  "dynamic_analysis_fixed_status": "Met",
+  "dynamic_analysis_fixed_justification": "Crashes found by fuzzing are fixed before the target is merged; none are open.",
+  "achieve_passing_status": "Unmet",
+  "achieve_passing_justification": "Not yet claimed: know_secure_design, know_common_errors, report_responses and enhancement_responses await the maintainer's confirmation.",
+  "dco_status": "Met",
+  "dco_justification": ".github/workflows/dco.yml requires Signed-off-by on commits from contributors; CONTRIBUTING.md 'Developer Certificate of Origin'.",
+  "governance_status": "Met",
+  "governance_justification": "docs/GOVERNANCE.md.",
+  "code_of_conduct_status": "Met",
+  "code_of_conduct_justification": "CODE_OF_CONDUCT.md (Contributor Covenant).",
+  "roles_responsibilities_status": "Met",
+  "roles_responsibilities_justification": "docs/GOVERNANCE.md 'Roles'; .github/CODEOWNERS.",
+  "access_continuity_status": "Unmet",
+  "access_continuity_justification": "One maintainer; no second person holds release credentials (docs/GOVERNANCE.md 'Continuity').",
+  "bus_factor_status": "Unmet",
+  "bus_factor_justification": "One maintainer writes nearly all commits.",
+  "documentation_roadmap_status": "Unmet",
+  "documentation_roadmap_justification": "No roadmap document covering the next year has been published; open enhancement issues (#40-#51) are not a roadmap.",
+  "documentation_architecture_status": "Met",
+  "documentation_architecture_justification": "docs/ARCHITECTURE.md.",
+  "documentation_security_status": "Met",
+  "documentation_security_justification": "docs/SECURITY.md, docs/PRIVACY.md and the Security section of docs/production-readiness.md.",
+  "documentation_quick_start_status": "Met",
+  "documentation_quick_start_justification": "README.md 'Quick Start'.",
+  "documentation_current_status": "Met",
+  "documentation_current_justification": "Documentation changes ship with the code change in the same pull request (pull request checklist).",
+  "documentation_achievements_status": "Unmet",
+  "documentation_achievements_justification": "The README shows CI and Scorecard badges but not yet an OpenSSF Best Practices badge.",
+  "accessibility_best_practices_status": "N/A",
+  "accessibility_best_practices_justification": "A library, CLI and HTTP service with no graphical interface.",
+  "internationalization_status": "N/A",
+  "internationalization_justification": "No end-user interface text.",
+  "sites_password_security_status": "N/A",
+  "sites_password_security_justification": "The project runs no site that stores passwords.",
+  "maintenance_or_update_status": "Met",
+  "maintenance_or_update_justification": "Actively maintained with dependency updates (.github/dependabot.yml).",
+  "vulnerability_report_credit_status": "N/A",
+  "vulnerability_report_credit_justification": "No vulnerability has been reported and fixed.",
+  "vulnerability_response_process_status": "Met",
+  "vulnerability_response_process_justification": "SECURITY.md describes private reporting, the response time and coordinated disclosure.",
+  "coding_standards_status": "Met",
+  "coding_standards_justification": "CONTRIBUTING.md 'Style Guidelines'; .editorconfig; rustfmt defaults.",
+  "coding_standards_enforced_status": "Met",
+  "coding_standards_enforced_justification": "ci.yml 'lint' runs cargo fmt --check and clippy -D warnings on every pull request.",
+  "build_standard_variables_status": "Met",
+  "build_standard_variables_justification": "cargo honours RUSTFLAGS, CARGO_* and the CARGO_PROFILE_* variables (ci.yml and scripts/ci/repro-build.sh rely on them).",
+  "build_preserve_debug_status": "Met",
+  "build_preserve_debug_justification": "Cargo.toml's release profile strips by default, and CARGO_PROFILE_RELEASE_STRIP/DEBUG override it.",
+  "build_non_recursive_status": "Met",
+  "build_non_recursive_justification": "Cargo resolves the dependency graph; there is no recursive make.",
+  "build_repeatable_status": "Met",
+  "build_repeatable_justification": ".github/workflows/reproducible.yml builds on two runners from different directories; hms-eval, hms-server, the napi cdylib and the crate are bit-for-bit identical, the wheel differs only in the SBOM maturin embeds (docs/RELEASING.md 'Reproducible builds').",
+  "installation_common_status": "Met",
+  "installation_common_justification": "README.md 'Installation': cargo add holographic-memory, npm install holographic-memory, pip install holographic-vsa.",
+  "installation_standard_variables_status": "N/A",
+  "installation_standard_variables_justification": "Distribution is through language package managers; there is no make install.",
+  "installation_development_quick_status": "Met",
+  "installation_development_quick_justification": "CONTRIBUTING.md 'Development Setup' (four commands).",
+  "external_dependencies_status": "Met",
+  "external_dependencies_justification": "Cargo.toml and the committed Cargo.lock, package.json and package-lock.json, pyproject.toml; a CycloneDX SBOM is produced for every release artefact (release.yml).",
+  "dependency_monitoring_status": "Met",
+  "dependency_monitoring_justification": ".github/dependabot.yml (cargo, uv, pip, npm, actions), cargo-deny in ci.yml, dependency-review.yml.",
+  "updateable_reused_components_status": "Met",
+  "updateable_reused_components_justification": "Dependencies come from crates.io, npm and PyPI; none is vendored.",
+  "interfaces_current_status": "Met",
+  "interfaces_current_justification": "clippy -D warnings includes the deprecation lint.",
+  "automated_integration_testing_status": "Met",
+  "automated_integration_testing_justification": "ci.yml runs tests/*.rs, the Node suites on three operating systems and the SDK against a real hms-server.",
+  "regression_tests_added50_status": "?",
+  "regression_tests_added50_justification": "Policy requires a test with each fix (CONTRIBUTING.md) but the share of the last six months' fixes with one has not been measured.",
+  "test_statement_coverage80_status": "Met",
+  "test_statement_coverage80_justification": "86.3% line coverage of the library (coverage.yml, .github/badges/coverage.json).",
+  "test_policy_mandated_status": "Met",
+  "test_policy_mandated_justification": "CONTRIBUTING.md 'Testing Policy'.",
+  "implement_secure_design_status": "Met",
+  "implement_secure_design_justification": "Constant-time secret comparison, zeroized keys, bounded allocations, fail-closed store opening and Argon2 key derivation (docs/SECURITY.md, src/core/security.rs, src/bin/hms-server.rs).",
+  "crypto_algorithm_agility_status": "Unmet",
+  "crypto_algorithm_agility_justification": "Ed25519 and AES-256-GCM are fixed; the storage format is versioned (format.json) but there is no algorithm negotiation.",
+  "crypto_credential_agility_status": "Met",
+  "crypto_credential_agility_justification": "Keys come from a passphrase and the server API key from the environment (HMS_API_KEY); no credential is hard-coded.",
+  "crypto_used_network_status": "Unmet",
+  "crypto_used_network_justification": "hms-server speaks plain HTTP and expects a TLS-terminating proxy (docs/SERVER.md); the SCITT client uses TLS.",
+  "crypto_tls12_status": "Met",
+  "crypto_tls12_justification": "The only TLS use is the optional SCITT client (ureq with rustls), which supports TLS 1.2 and 1.3.",
+  "crypto_certificate_verification_status": "Met",
+  "crypto_certificate_verification_justification": "ureq verifies certificates by default and the code does not disable it.",
+  "crypto_verification_private_status": "Met",
+  "crypto_verification_private_justification": "TLS verification is not bypassed and no private data is sent before it.",
+  "signed_releases_status": "Unmet",
+  "signed_releases_justification": "Past releases predate the pipeline; release.yml attests SLSA provenance and SBOMs for every artefact and attaches the bundle, but no release has shipped through it yet.",
+  "version_tags_signed_status": "Unmet",
+  "version_tags_signed_justification": "The existing tags are annotated but not signed; docs/RELEASING.md requires `git tag -s` from now on.",
+  "input_validation_status": "Met",
+  "input_validation_justification": "Request, file and wire inputs are validated and size-limited (docs/production-readiness.md 'Documents and resource limits'; docs/SERVER.md); fuzz targets cover the parsers.",
+  "hardening_status": "Unmet",
+  "hardening_justification": "No explicit hardening flags beyond Rust's defaults.",
+  "assurance_case_status": "Unmet",
+  "assurance_case_justification": "No assurance case document exists; docs/SECURITY.md has the threat model only.",
+  "achieve_silver_status": "Unmet",
+  "achieve_silver_justification": "Silver is not complete (see the unmet silver criteria).",
+  "contributors_unassociated_status": "Unmet",
+  "contributors_unassociated_justification": "One organisation accounts for essentially all contributions.",
+  "copyright_per_file_status": "Unmet",
+  "copyright_per_file_justification": "211 Rust files all carry the notice except one (src/bin/hms-server/concurrency_tests.rs); many JavaScript, TypeScript and Python files do not.",
+  "license_per_file_status": "Unmet",
+  "license_per_file_justification": "SPDX identifiers are in the Rust files but not in all JavaScript, TypeScript and Python files.",
+  "small_tasks_status": "Met",
+  "small_tasks_justification": "Twelve open issues carry the 'good first issue' label (https://github.com/writerslogic/holographic-memory/labels/good%20first%20issue).",
+  "require_2FA_status": "Unmet",
+  "require_2FA_justification": "The writerslogic organisation does not require two-factor authentication.",
+  "secure_2FA_status": "Unmet",
+  "secure_2FA_justification": "Not required, so not hardware-key based.",
+  "code_review_standards_status": "Met",
+  "code_review_standards_justification": "docs/GOVERNANCE.md 'How decisions are made' and the pull request checklist.",
+  "two_person_review_status": "Unmet",
+  "two_person_review_justification": "The sole maintainer merges their own pull requests using the branch-protection bypass; Scorecard 'Code-Review' is 0.",
+  "build_reproducible_status": "Met",
+  "build_reproducible_justification": ".github/workflows/reproducible.yml; see build_repeatable.",
+  "test_statement_coverage90_status": "Unmet",
+  "test_statement_coverage90_justification": "Line coverage is 86.3%.",
+  "test_branch_coverage80_status": "Unmet",
+  "test_branch_coverage80_justification": "Branch coverage is not measured.",
+  "hardened_site_status": "?",
+  "hardened_site_justification": "github.com serves the repository with HSTS and CSP headers; the project site's headers have not been audited against the gold list.",
+  "security_review_status": "Unmet",
+  "security_review_justification": "No independent security review has been recorded."
+}

holographic_memory_py-0.6.3/.dockerignore

@@ -0,0 +1,10 @@
+.git
+.worktrees
+**/target
+**/node_modules
+**/.venv
+assets
+benchmarks/results
+docs
+figures
+hms-data

holographic_memory_py-0.6.3/.editorconfig

@@ -0,0 +1,23 @@
+root = true
+
+[*]
+indent_style = tab
+indent_size = 4
+tab_width = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{yml,yaml}]
+indent_style = space
+indent_size = 2
+
+[*.py]
+indent_style = space
+indent_size = 4
+
+[*.md]
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = false

holographic_memory_py-0.6.3/.gitattributes

@@ -0,0 +1,37 @@
+# Golden stores are byte-exact fixtures (checksums cover their text files): no EOL conversion.
+tests/golden/** -text
+benchmarks/results/vibe_v1/**/*.npz filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/**/*.parquet filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/rotation/*.ids.u32 filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/rotation/rotation-arxiv.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/rotation/rotation-inaturalist.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/rotation/rotation-laion.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/rotation/rotation-laion-escape.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/**/*.log filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/native/*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/diagnostic/laion-*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/vibe_v1/leaderboard.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v1/llama-*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v1/yi-*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v1/*.hdf5 filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v1/**/*.hdf5 filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v4/diagnostics/*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/query_aware_graph_v4/**/*.hdf5 filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/longmemeval_dev_answers_*.json filter=lfs diff=lfs merge=lfs -text
+benchmarks/results/manifold_schema_synthetic.json.gz filter=lfs diff=lfs merge=lfs -text
+
+# Committed before the LFS rule above; kept as regular blobs so checkouts do not warn.
+benchmarks/results/longmemeval_dev_answers_local30b_v1.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_local30b_v1_spend.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_local30b_v1_summary.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v1.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v1_spend.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v1_summary.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v2_spend.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v2_summary.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v2b_spend.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v2b_summary.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v3.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v3_spend.json -filter -diff -merge text
+benchmarks/results/longmemeval_dev_answers_v3_summary.json -filter -diff -merge text
+benchmarks/results/manifold_schema_synthetic.json.gz -filter -diff -merge -text

holographic_memory_py-0.6.3/.github/CODEOWNERS

@@ -0,0 +1,22 @@
+# Copyright 2024-2026 WritersLogic Contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+# Every owner must be a user or a team that exists and has write access, otherwise GitHub
+# ignores the rule and the "require review from code owners" protection checks nothing
+# (`gh api repos/writerslogic/holographic-memory/codeowners/errors` lists problems).
+# Add a team here when one exists; until then the maintainer owns everything.
+
+* @dcondrey
+
+# Security-sensitive code, release machinery and supply-chain configuration.
+/src/core/security.rs @dcondrey
+/src/core/audit.rs @dcondrey
+/src/core/storage.rs @dcondrey
+/src/core/durable_file.rs @dcondrey
+/src/core/provenance/ @dcondrey
+/fuzz/ @dcondrey
+/.github/ @dcondrey
+/scripts/ci/ @dcondrey
+/deny.toml @dcondrey
+/SECURITY.md @dcondrey
+/docs/RELEASING.md @dcondrey

holographic_memory_py-0.6.3/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [writerslogic]

holographic_memory_py-0.6.3/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,56 @@
+name: Bug Report
+description: Report a bug in HMS
+title: "[Bug]: "
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report this bug!
+        Do not include API keys or secrets in this report.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear description of what the bug is
+      placeholder: When I call the HMS store/search API, it ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior
+      placeholder: |
+        1. ...
+        2. ...
+        3. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What you expected to happen
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version / commit
+      description: crate/package version or the commit hash
+    validations:
+      required: true
+
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, language runtime, and relevant configuration
+      placeholder: macOS 15, Node 20, rustc 1.91
+    validations:
+      required: false

holographic_memory_py-0.6.3/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security Vulnerability
+    url: https://github.com/writerslogic/holographic-memory/security/advisories/new
+    about: Please report security vulnerabilities privately — see SECURITY.md. Do not open a public issue.
+  - name: Question or idea
+    url: https://github.com/writerslogic/holographic-memory/discussions
+    about: Ask how to do something, or float an idea, in Discussions before opening an issue.
+  - name: Documentation
+    url: https://docs.holographic-memory.com/
+    about: Quickstart, concepts, API and security notes.

holographic_memory_py-0.6.3/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,28 @@
+name: Feature Request
+description: Suggest an improvement to HMS
+title: "[Feature]: "
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem would this solve? What are you trying to do that is hard today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed Solution
+      description: A clear description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Any alternative approaches you have thought about.
+    validations:
+      required: false

holographic_memory_py-0.6.3/.github/SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| v0.6.x  | :white_check_mark: |
+| v0.5.x  | :white_check_mark: |
+| < v0.5  | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of HMS seriously. If you believe you have found a security vulnerability, please do not open a public issue.
+
+Please report vulnerabilities by:
+- Opening a [draft security advisory](https://github.com/writerslogic/holographic-memory/security/advisories/new) on GitHub
+- Contacting the WritersLogic security team at security@writerslogic.com
+
+We will acknowledge your report within 48 hours and provide a timeline for a fix if applicable.
+
+## Security Practices
+
+- All dependencies are audited with `cargo-deny`
+- CI runs `cargo clippy` with `-D warnings`
+- Apache-2.0 licensed with full provenance tracking

holographic_memory_py-0.6.3/.github/SUPPORT.md

@@ -0,0 +1,12 @@
+# Support
+
+Need help with HMS?
+
+## Documentation
+Please check the [README.md](../README.md) for usage examples and core concepts.
+
+## GitHub Issues
+For bugs and feature requests, please use the [Issue Tracker](https://github.com/writerslogic/holographic-memory/issues).
+
+## Discussions
+For general questions or architectural discussions, please use [GitHub Discussions](https://github.com/writerslogic/holographic-memory/discussions).

holographic_memory_py-0.6.3/.github/badges/coverage.json

@@ -0,0 +1,6 @@
+{
+  "schemaVersion": 1,
+  "label": "coverage",
+  "message": "86.3%",
+  "color": "brightgreen"
+}

holographic_memory_py-0.6.3/.github/dependabot.yml

@@ -0,0 +1,108 @@
+# Copyright 2024-2026 WritersLogic Contributors
+# SPDX-License-Identifier: Apache-2.0
+#
+# Version updates for every manifest the project ships or builds from. Security
+# updates are separate (repository setting) and are not limited by the groups or
+# the open-PR caps below. Minor and patch bumps are grouped per ecosystem so a week
+# of churn is one PR; majors arrive one dependency per PR because they need review.
+# A 3-day cooldown keeps a freshly published (possibly yanked) release out of PRs.
+version: 2
+
+updates:
+  - package-ecosystem: "cargo"
+    directories:
+      - "/"
+      - "/fuzz"
+      - "/bindings/wasm"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 3
+    labels: ["dependencies", "rust", "automated"]
+    commit-message:
+      prefix: "deps(rust)"
+      include: "scope"
+    groups:
+      rust-minor-patch:
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 3
+    labels: ["dependencies", "python", "automated"]
+    commit-message:
+      prefix: "deps(python)"
+      include: "scope"
+    groups:
+      python-minor-patch:
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: "pip"
+    directory: "/bindings/python/holographic-sdk"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 3
+    labels: ["dependencies", "python", "automated"]
+    commit-message:
+      prefix: "deps(sdk)"
+      include: "scope"
+    groups:
+      sdk-minor-patch:
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 3
+    # The platform packages are published by release.yml together with the root package; until
+    # a version exists on the registry, dependabot's lookup of them fails with a 404.
+    ignore:
+      - dependency-name: "holographic-memory-*"
+    labels: ["dependencies", "javascript", "automated"]
+    commit-message:
+      prefix: "deps(npm)"
+      include: "scope"
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "06:00"
+      timezone: "America/Los_Angeles"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 3
+    labels: ["dependencies", "ci", "automated"]
+    commit-message:
+      prefix: "ci(deps)"
+      include: "scope"
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

holographic_memory_py-0.6.3/.github/pull_request_template.md

@@ -0,0 +1,22 @@
+## What and why
+<!-- The change and the problem it solves. Link the issue: "Closes #123". -->
+
+## Type of change
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation
+- [ ] Performance
+- [ ] Refactor or chore
+
+## Checklist
+- [ ] Every commit is signed off (`git commit -s`); see [CONTRIBUTING.md](../CONTRIBUTING.md#sign-off-your-commits-dco)
+- [ ] `cargo fmt -- --check`, `cargo clippy --all-targets -- -D warnings` and `cargo test` pass, and so do the same with `--all-features`
+- [ ] A bug fix or new logic has a test that fails without the change, or the description says why not
+- [ ] A change that depends on a Cargo feature builds under the feature combinations CI runs
+- [ ] Any number in the docs or README traces to a committed file under `benchmarks/results/`, with the tested range stated
+- [ ] Documentation updated where behavior changed
+- [ ] New files carry the Apache-2.0 header
+
+## How I verified it
+<!-- The command you ran and what it showed. For a UI or export change, the real surface. -->