hypermind 1.0.0__tar.gz → 1.4.4__tar.gz

hypermind-1.4.4/.github/workflows/release-simple.yml.bak

@@ -0,0 +1,21 @@
+name: Release
+
+on:
+  push:
+    branches: [release]
+    tags: ['v*']
+  pull_request:
+    branches: [release]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  release:
+    uses: ZySec-AI/.github/.github/workflows/_reusable-release.yml@develop
+    secrets: inherit
+    with:
+      environment: production
+      notify: true

hypermind-1.4.4/.github/workflows/release.yml

@@ -0,0 +1,159 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  guard-source-branch:
+    name: guard — release tag must descend from develop
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: ensure tag is reachable from origin/develop
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin develop:refs/remotes/origin/develop
+          REF="${{ github.sha }}"
+          if git merge-base --is-ancestor "$REF" origin/develop; then
+            echo "✓ ${REF} is an ancestor of origin/develop"
+          else
+            echo "✗ ${REF} is NOT reachable from origin/develop — tag must be cut from develop"
+            exit 1
+          fi
+
+  test:
+    name: test (py${{ matrix.python }})
+    needs: guard-source-branch
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.11', '3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[test,openai,anthropic,api,otel,mcp]" quantcrypt pymerkle
+      - name: run tests
+        # omit list + fail_under=80 come from [tool.coverage] in pyproject.toml
+        run: pytest --cov=src/hypermind --cov=src/hmctl -q
+
+  build:
+    name: build sdist + wheel
+    runs-on: ubuntu-latest
+    needs: test
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install --upgrade pip build twine
+      - run: python -m build
+      - run: twine check dist/*
+      - name: hash artifacts for cosign
+        id: hash
+        run: |
+          cd dist
+          echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  cosign:
+    name: cosign keyless sign
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: sigstore/cosign-installer@v3
+      - name: sign dist artifacts (keyless OIDC)
+        run: |
+          set -euo pipefail
+          for f in dist/*.whl dist/*.tar.gz; do
+            cosign sign-blob --yes --bundle "${f}.bundle" "${f}"
+          done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/*.bundle
+          retention-days: 30
+
+  publish-pypi:
+    name: publish → PyPI
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hypermind
+    permissions:
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  github-release:
+    name: GitHub release
+    runs-on: ubuntu-latest
+    needs: [cosign, publish-pypi]
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/
+      - name: create GitHub release and upload assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          TAG="${{ github.ref_name }}"
+          ASSETS=()
+          for f in dist/*.whl dist/*.tar.gz dist/*.bundle; do
+            [[ -f "$f" ]] && ASSETS+=("$f")
+          done
+          gh release create "${TAG}" \
+            --title "HyperMind ${TAG}" \
+            --generate-notes \
+            "${ASSETS[@]}"

hypermind-1.4.4/.github/workflows/security.yml

@@ -0,0 +1,71 @@
+name: Security
+
+on:
+  push:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  pull_request:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+  pull-requests: write
+
+jobs:
+  # Push / manual — full scan on release/stage, fast on develop
+  push-scan:
+    name: Security Scan (push)
+    if: github.event_name != 'pull_request'
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: ${{ github.ref != 'refs/heads/release' && github.ref != 'refs/heads/stage' }}
+    secrets: inherit
+
+  # PRs to develop or stage — fast scan always
+  pr-fast:
+    name: Security Scan (PR fast)
+    if: github.event_name == 'pull_request' && (github.base_ref == 'develop' || github.base_ref == 'stage')
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: true
+    secrets: inherit
+
+  # PRs to release with hotfix label — fast scan
+  pr-release-hotfix:
+    name: Security Gate — release (hotfix)
+    if: >
+      github.event_name == 'pull_request' &&
+      github.base_ref == 'release' &&
+      contains(github.event.pull_request.labels.*.name, 'hotfix')
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: true
+    secrets: inherit
+
+  # PRs to release without hotfix label — full scan (blocking)
+  pr-release-full:
+    name: Security Gate — release (full)
+    if: >
+      github.event_name == 'pull_request' &&
+      github.base_ref == 'release' &&
+      !contains(github.event.pull_request.labels.*.name, 'hotfix')
+    uses: ZySec-AI/.github/.github/workflows/_reusable-security.yml@develop
+    with:
+      auto_detect: true
+      fast-mode: false
+    secrets: inherit

hypermind-1.4.4/.gitignore

@@ -0,0 +1,151 @@
+# =============================================================================
+# .gitignore — hypermind-specs
+# Organised by category. Keep entries alphabetised within each section.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Secrets, credentials, certificates
+# (NEVER commit these — even for tests, generate at runtime via fixtures)
+# -----------------------------------------------------------------------------
+*.crt
+*.key
+*.keystore
+*.p12
+*.pem
+*.pfx
+.env
+.env.*
+!.env.example
+credentials.json
+credentials.yaml
+credentials.yml
+secrets.json
+secrets.yaml
+secrets.yml
+
+# -----------------------------------------------------------------------------
+# Private working notes / internal-only directories
+# Per CLAUDE.md: docs/expert-panel/ is internal review notes, never public.
+# -----------------------------------------------------------------------------
+docs/expert-panel/
+notes/
+private/
+scratch/
+.scratch/
+TODO.private.md
+*.private.md
+
+# -----------------------------------------------------------------------------
+# AI / agent / coding-assistant working dirs
+# -----------------------------------------------------------------------------
+.aider*
+.claude/
+.codebase/
+.cursor/
+.vibekit/
+CLAUDE.md
+CLAUDE.local.md
+
+# -----------------------------------------------------------------------------
+# IDE / editor state
+# -----------------------------------------------------------------------------
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# -----------------------------------------------------------------------------
+# OS metadata
+# -----------------------------------------------------------------------------
+.DS_Store
+._*
+Thumbs.db
+desktop.ini
+
+# -----------------------------------------------------------------------------
+# Python — bytecode, caches, virtualenvs
+# -----------------------------------------------------------------------------
+__pycache__/
+*.py[cod]
+*$py.class
+.Python
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.tox/
+.venv/
+env/
+venv/
+
+# -----------------------------------------------------------------------------
+# Python — build / distribution artefacts
+# -----------------------------------------------------------------------------
+*.egg
+*.egg-info/
+.eggs/
+build/
+dist/
+pip-wheel-metadata/
+wheels/
+sdist/
+share/python-wheels/
+
+# -----------------------------------------------------------------------------
+# Coverage / test reports
+# -----------------------------------------------------------------------------
+.coverage
+.coverage.*
+coverage.json
+coverage.xml
+htmlcov/
+nosetests.xml
+.hypothesis/
+
+# -----------------------------------------------------------------------------
+# Lock files (project policy: pip-compile locks regenerated locally, not tracked)
+# -----------------------------------------------------------------------------
+requirements-dev.lock
+requirements.lock
+
+# -----------------------------------------------------------------------------
+# Logs, dumps, core files
+# -----------------------------------------------------------------------------
+*.dump
+*.log
+core.*
+
+# -----------------------------------------------------------------------------
+# Fuzzing corpora & crashes (corpora regenerated locally)
+# -----------------------------------------------------------------------------
+fuzz/corpus/
+fuzz/crashes/
+# AI context manifest
+.codebase.json
+.codebase.cache.json
+
+# SimLab — Vue webui
+webui/node_modules/
+webui/dist/
+# src/hypermind/simlab/ui/dist/  # ponytail: committed as pre-built artifact shipped with package
+
+# Stray scenario artifacts (output goes to ~/.hypermind/sims/ now)
+persona_audit.jsonl
+persona_trace.json
+.mcp.json
+trace.json
+
+# -----------------------------------------------------------------------------
+# RelataDB local data (object store, WAL, custom_types.jsonl, flushed segments)
+# Operator must supply RELATA_DATA_DIR pointing here; never commit server state
+# -----------------------------------------------------------------------------
+data/relata/
+
+# Benchmark run artefacts (large raw traces). Slim traces + report.html kept locally.
+experiments/output/
+
+# Local scratch experiments (reports, benchmarks) — not shipped
+experiments/
+
+# mkdocs build output
+site/

hypermind-1.4.4/.gitleaks.toml

@@ -0,0 +1,28 @@
+# gitleaks configuration — extends the default ruleset with an allowlist of
+# known false positives so the secret-scan gate stays green without weakening
+# real detection.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "HyperMind false positives (public DIDs, generated bundles, param names)"
+# Generated web bundle: minified JS/CSS built from src; contains public example
+# DID keys and doc snippets, never real secrets. Regenerated by `make webui`.
+paths = [
+  '''src/hypermind/simlab/ui/dist/.*''',
+]
+# Match against the whole matched line so the patterns below neutralise the
+# generic-api-key rule on public identifiers and type annotations.
+regexTarget = "line"
+regexes = [
+  # DID keys are public identifiers by construction (did:key:z6Mk...), not secrets.
+  '''did:key:''',
+  # `client_key:` here is a function-parameter type annotation in
+  # src/hypermind/transport/tls_profile.py, not a credential assignment.
+  # Matches: bytes, Ed25519PrivateKey, or any type annotation after the colon.
+  '''client_key:\s*\w''',
+  # Conformance-vector fields in tests/conformance/vectors/*.json hold
+  # CBOR-encoded capability-token bytes (COSE_Sign1 envelopes over generated
+  # Ed25519 test keys). They are deterministic test fixtures, not credentials.
+  '''"(leaf_token_hex|root_token_hex|token_bytes_hex|parent_token_hex)"\s*:''',
+]