hypermind 0.11.0__tar.gz

hypermind-0.11.0/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.py]
+indent_size = 4
+
+[*.{yml,yaml,json,toml,md}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

hypermind-0.11.0/.gitattributes

@@ -0,0 +1,12 @@
+# Enforce LF for files that participate in cryptographic hashing or
+# byte-exact wire-format comparisons. CRLF on Windows checkouts would
+# otherwise change ENVELOPE_SCHEMA_HASH (BLAKE3 of the CDDL bytes) and
+# break Appendix Z conformance vectors. See tests/test_appendix_z_conformance.py.
+*.cddl text eol=lf
+*.cbor binary
+*.json text eol=lf
+*.py text eol=lf
+*.toml text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.md text eol=lf

hypermind-0.11.0/.github/FUNDING.yml

@@ -0,0 +1,11 @@
+# HyperMind welcomes funding to sustain open, secure agent infrastructure.
+#
+# We are actively pursuing support from:
+#   - NLnet (NGI Zero)
+#   - OpenSSF Alpha-Omega
+#   - Alfred P. Sloan Foundation
+#   - Open Philanthropy
+#
+# See ROADMAP.md (v0.6.14) for the funded-work plan and milestones.
+
+github: [ZySec-AI]

hypermind-0.11.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,105 @@
+name: Bug report
+description: Report a defect in HyperMind (SDK, CLI, spec, or reference verifier).
+title: "[bug] <short summary>"
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug report. Please fill out the
+        sections below as completely as you can — the more we know, the faster
+        we can fix it.
+
+        **Security issues:** if this bug has security impact, please do **not**
+        file it here. Use the private vulnerability reporting channel described
+        in [SECURITY.md](../../SECURITY.md).
+
+  - type: input
+    id: hypermind-version
+    attributes:
+      label: HyperMind version
+      description: Output of `hmctl --version` or `pip show hypermind`.
+      placeholder: "e.g. 0.1.0a0"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: python-version
+    attributes:
+      label: Python version
+      options:
+        - "3.11"
+        - "3.12"
+        - "3.13"
+        - "other (please specify in 'Additional context')"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - other (please specify in 'Additional context')
+    validations:
+      required: true
+
+  - type: input
+    id: wire-version
+    attributes:
+      label: Wire-format version
+      description: The HyperMind wire/protocol version in use, if known.
+      placeholder: "e.g. wire/1"
+    validations:
+      required: false
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear and concise description of the actual behaviour.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behaviour
+      description: What did you expect to happen instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal, deterministic steps. Code snippets and `hmctl`
+        invocations are very welcome.
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / tracebacks
+      description: Paste relevant log output. Will be auto-rendered as a code block.
+      render: shell
+    validations:
+      required: false
+
+  - type: textarea
+    id: additional-context
+    attributes:
+      label: Additional context
+      description: Anything else that might help — environment details,
+        related issues, screenshots, etc.
+    validations:
+      required: false

hypermind-0.11.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,10 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and discussion
+    url: https://github.com/ZySec-AI/hypermind/discussions
+    about: For usage questions, design conversations, and general discussion,
+      please use GitHub Discussions instead of opening an issue.
+  - name: Report a security vulnerability
+    url: https://github.com/ZySec-AI/hypermind/blob/main/SECURITY.md
+    about: Do not file public issues for security vulnerabilities. Follow the
+      private vulnerability reporting process described in SECURITY.md.

hypermind-0.11.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,70 @@
+name: Feature request
+description: Suggest a new capability, API, or spec change for HyperMind.
+title: "[feature] <short summary>"
+labels: ["enhancement", "needs-design-review"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for proposing an improvement to HyperMind. Substantive proposals
+        — especially those touching the wire format, cryptography, dispute
+        FSM, or capability model — will go through a design-review cycle
+        before implementation.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem statement
+      description: What problem are you trying to solve? Who is affected, and
+        what is the cost of the status quo?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposed
+    attributes:
+      label: Proposed solution
+      description: Describe the change you'd like to see. API sketches,
+        wire-format diffs, and pseudocode are very welcome.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What other approaches did you weigh? Why did you discard them?
+    validations:
+      required: false
+
+  - type: dropdown
+    id: contribution
+    attributes:
+      label: Willingness to contribute
+      options:
+        - "I'll PR"
+        - "I'd help review"
+        - "Just suggesting"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Spec / code area
+      multiple: true
+      options:
+        - wire
+        - crypto
+        - dispute
+        - capability
+        - transport
+        - agent
+        - observability
+        - mcp
+        - cli
+        - docs
+        - ci
+        - other
+    validations:
+      required: true

hypermind-0.11.0/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,64 @@
+# Pull Request
+
+<!--
+Thanks for contributing to HyperMind. Please fill out every section below.
+PRs that skip the checklist will be sent back for revisions.
+-->
+
+## Summary
+
+<!-- 2-3 sentences: what does this PR do, and why? Focus on the "why". -->
+
+## Type of change
+
+- [ ] Bug fix
+- [ ] New feature
+- [ ] Breaking change
+- [ ] Documentation
+- [ ] Refactor
+- [ ] Security
+- [ ] Performance
+
+## Spec / code area
+
+- [ ] wire
+- [ ] crypto
+- [ ] dispute
+- [ ] capability
+- [ ] transport
+- [ ] agent
+- [ ] observability
+- [ ] mcp
+- [ ] cli
+- [ ] docs
+- [ ] ci
+
+## Checklist
+
+<!-- Mirrors CONTRIBUTING.md. All boxes must be ticked before merge. -->
+
+- [ ] Tests added/updated
+- [ ] Coverage ≥97% (≥99% line, ≥95% branch by v1.0)
+- [ ] No regressions: `pytest tests/test_self_heal_cycle1.py tests/test_self_heal_cycle2.py` passes
+- [ ] Demos in `examples/` still run
+- [ ] Docs updated if public API changed
+- [ ] CHANGELOG entry added under `[Unreleased]`
+- [ ] DCO `Signed-off-by:` trailer on every commit
+- [ ] Security tag applied if touching `wire.py`, `crypto/`, `capability.py`, `dispute.py`, or `knowledge/transparency.py`
+
+## Issue references
+
+<!-- e.g. Closes #123, Refs #456 -->
+
+Closes #
+Refs #
+
+## Notes for reviewers
+
+<!--
+Anything reviewers should pay special attention to:
+- Tricky logic
+- Deliberate trade-offs
+- Areas where you'd like extra scrutiny
+- Follow-up work intentionally left out of this PR
+-->

hypermind-0.11.0/.github/renovate.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:base", "helpers:pinGitHubActionDigests"],
+  "labels": ["dependencies"],
+  "schedule": ["before 6am on Monday"]
+}

hypermind-0.11.0/.github/workflows/check-license.yml

@@ -0,0 +1,14 @@
+name: License Compatibility Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  check-license:
+    uses: ZySec-AI/.github/.github/workflows/_reusable-check-license.yml@develop
+    secrets: inherit

hypermind-0.11.0/.github/workflows/code-review-pr.yml

@@ -0,0 +1,27 @@
+name: Code Review (PR)
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [develop]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  review:
+    if: |
+      !contains(github.event.pull_request.labels.*.name, 'bot-skip') &&
+      github.event.pull_request.draft == false
+    uses: ZySec-AI/.github/.github/workflows/_reusable-code-review.yml@develop
+    secrets:
+      LLM_PROVIDER: ${{ secrets.LLM_PROVIDER }}
+      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+      LLM_MODEL: ${{ secrets.LLM_MODEL }}
+      ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
+    with:
+      mode: pr-review
+      fail_on: NEVER

hypermind-0.11.0/.github/workflows/hotfix-security.yml

@@ -0,0 +1,31 @@
+name: Security (Hotfix Fast-Path)
+
+on:
+  pull_request:
+    branches: [release]
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+  pull-requests: write
+
+jobs:
+  fast-security:
+    name: Fast Security Gate (hotfix)
+    if: contains(github.event.pull_request.labels.*.name, 'hotfix')
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: true
+    secrets: inherit
+
+  full-security:
+    name: Full Security Gate (non-hotfix)
+    if: "!contains(github.event.pull_request.labels.*.name, 'hotfix')"
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: false
+    secrets: inherit

hypermind-0.11.0/.github/workflows/issue-auto-fix.yml

@@ -0,0 +1,24 @@
+name: Issue Auto-Fix
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  fix:
+    if: github.event.label.name == 'bot-fix-please'
+    uses: ZySec-AI/.github/.github/workflows/_reusable-code-review.yml@develop
+    secrets:
+      LLM_PROVIDER: ${{ secrets.LLM_PROVIDER }}
+      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+      LLM_MODEL: ${{ secrets.LLM_MODEL }}
+      ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
+    with:
+      mode: issue-fix
+      fail_on: NEVER

hypermind-0.11.0/.github/workflows/issue-triage.yml

@@ -0,0 +1,25 @@
+name: Issue Triage
+
+on:
+  issues:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  triage:
+    if: |
+      !contains(github.event.issue.labels.*.name, 'bot-skip') &&
+      !contains(github.event.issue.labels.*.name, 'bot-reviewed')
+    uses: ZySec-AI/.github/.github/workflows/_reusable-code-review.yml@develop
+    secrets:
+      LLM_PROVIDER: ${{ secrets.LLM_PROVIDER }}
+      LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
+      LLM_BASE_URL: ${{ secrets.LLM_BASE_URL }}
+      LLM_MODEL: ${{ secrets.LLM_MODEL }}
+      ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}
+    with:
+      mode: issue-triage

hypermind-0.11.0/.github/workflows/pr-standards.yml

@@ -0,0 +1,16 @@
+name: PR Standards
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, labeled, unlabeled, ready_for_review]
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: read
+
+jobs:
+  validate:
+    uses: ZySec-AI/.github/.github/workflows/_reusable-pr-standards.yml@develop
+    secrets:
+      ORG_ADMIN_TOKEN: ${{ secrets.ORG_ADMIN_TOKEN }}

hypermind-0.11.0/.github/workflows/quality.yml

@@ -0,0 +1,28 @@
+name: Quality Gates
+
+on:
+  push:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  pull_request:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gates:
+    uses: ZySec-AI/.github/.github/workflows/_reusable-quality.yml@develop
+    secrets: inherit
+    with:
+      auto_detect: true

hypermind-0.11.0/.github/workflows/release.yml

@@ -0,0 +1,209 @@
+name: release
+
+on:
+  push:
+    branches:
+      - 'release'         # bare release branch (must descend from develop)
+      - 'release/**'      # release/v0.1.0a1, release/v0.2.0, etc.
+    tags:
+      - 'v*'              # v0.1.0a1, v0.2.0, ... (canonical release)
+  workflow_dispatch:       # manual trigger from the Actions tab
+
+permissions:
+  contents: read
+  id-token: write          # REQUIRED for PyPI trusted publishing (OIDC) + Sigstore cosign
+  attestations: write      # REQUIRED for GitHub attestations (PEP 740)
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  guard-source-branch:
+    name: guard — release ref must descend from develop
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout (full history needed for ancestry check)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: ensure release ref is reachable from origin/develop
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin develop:refs/remotes/origin/develop
+          REF="${{ github.sha }}"
+          if git merge-base --is-ancestor "$REF" origin/develop; then
+            echo "✓ ${REF} is an ancestor of origin/develop — release pipeline may proceed"
+          else
+            echo "✗ ${REF} is NOT reachable from origin/develop."
+            echo ""
+            echo "  Releases MUST be cut from a commit that has been merged into develop."
+            echo "  Direct pushes to release/** branches or tags from feature/main branches"
+            echo "  are blocked. Open a PR into develop first, then create the release branch"
+            echo "  or tag from the merged develop HEAD."
+            exit 1
+          fi
+
+  test:
+    name: test (py${{ matrix.python }})
+    needs: guard-source-branch
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        python: ['3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e .[test] quantcrypt pymerkle
+      - run: pytest --cov=src/hypermind --cov=src/hmctl --cov-fail-under=78 -q
+
+  build:
+    name: build sdist + wheel
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install --upgrade pip build
+      - run: python -m build           # produces dist/*.tar.gz + dist/*.whl
+      - run: python -m pip install twine && twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  # ---------------------------------------------------------------------------
+  # SLSA L3 provenance — runs in parallel with cosign signing.
+  # The slsa-github-generator reusable workflow runs the build in an isolated
+  # environment and generates a signed SLSA provenance attestation. Pinned to
+  # v1.10.0 by tag (SHA-pinning via Renovate is the recommended next step).
+  # ---------------------------------------------------------------------------
+  slsa-provenance:
+    name: SLSA L3 provenance
+    needs: build
+    # Only generate provenance on version tags (not release/* branches).
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+      contents: write
+      actions: read          # required by slsa-github-generator
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
+    with:
+      base64-subjects: ""    # populated automatically from the dist artifact
+      upload-assets: true    # attach .intoto.jsonl to the GitHub release
+
+  cosign:
+    name: cosign keyless sign
+    runs-on: ubuntu-latest
+    needs: build
+    # Only sign on version tags — signing release/* branches is unnecessary noise.
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write   # OIDC token for Sigstore Fulcio
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Sign dist artifacts (keyless OIDC)
+        # cosign sign-blob uses the GitHub Actions OIDC token to obtain a
+        # short-lived Sigstore Fulcio certificate and writes the signature +
+        # certificate to a .sigstore bundle alongside each artifact.
+        # --yes suppresses the interactive consent prompt in CI.
+        run: |
+          set -euo pipefail
+          for f in dist/*.whl dist/*.tar.gz; do
+            echo "Signing ${f} ..."
+            cosign sign-blob --yes \
+              --bundle "${f}.bundle" \
+              "${f}"
+          done
+
+      - name: Upload .bundle files as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/*.bundle
+          retention-days: 30
+
+  publish-pypi:
+    name: publish → PyPI (prod)
+    runs-on: ubuntu-latest
+    needs: [build]
+    # Prod only on a tag — release branches go to TestPyPI only.
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hypermind
+    permissions:
+      id-token: write      # OIDC trusted publishing — no API key required
+      attestations: write  # PEP 740 attestations attached to each PyPI artefact
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true   # PEP 740 — signed SLSA provenance per PyPI artefact
+
+  # ---------------------------------------------------------------------------
+  # GitHub Release — runs last, after signing and provenance are complete.
+  # Attaches: dist/*.whl, dist/*.tar.gz, *.bundle (Sigstore), *.intoto.jsonl
+  # (SLSA provenance uploaded by slsa-github-generator via upload-assets: true).
+  # ---------------------------------------------------------------------------
+  github-release:
+    name: GitHub release
+    runs-on: ubuntu-latest
+    needs: [cosign, publish-pypi, slsa-provenance]
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write   # create release + upload assets
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Download Sigstore bundles
+        uses: actions/download-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/
+
+      - name: Create GitHub release and upload assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          TAG="${{ github.ref_name }}"
+
+          # Build asset list: wheels, sdists, and their .bundle files.
+          ASSETS=()
+          for f in dist/*.whl dist/*.tar.gz dist/*.bundle; do
+            [[ -f "$f" ]] && ASSETS+=("$f")
+          done
+
+          gh release create "${TAG}" \
+            --title "HyperMind ${TAG}" \
+            --generate-notes \
+            "${ASSETS[@]}"