hypermind 1.12.0__tar.gz → 2.0.0__tar.gz

hypermind-2.0.0/.githooks/pre-push

@@ -0,0 +1,6 @@
+#!/bin/sh
+# ponytail: block push on ruff lint/format errors
+set -e
+echo "» ruff check..."
+.venv/bin/ruff check src tests examples
+.venv/bin/ruff format --check src tests examples

hypermind-2.0.0/.github/workflows/quality.yml

@@ -0,0 +1,29 @@
+name: Quality Gates
+
+on:
+  push:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  pull_request:
+    branches: [develop, stage, release]
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+      - 'LICENSE'
+      - '.gitignore'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gates:
+    uses: ZySec-AI/.github/.github/workflows/_reusable-quality.yml@develop
+    secrets: inherit
+    with:
+      auto_detect: true
+      coverage_threshold: 75

hypermind-2.0.0/.github/workflows/release.yml

@@ -0,0 +1,271 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: write
+  packages: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  guard-source-branch:
+    name: guard — release tag must descend from develop
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: ensure tag is reachable from origin/develop
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin develop:refs/remotes/origin/develop
+          REF="${{ github.sha }}"
+          if git merge-base --is-ancestor "$REF" origin/develop; then
+            echo "✓ ${REF} is an ancestor of origin/develop"
+          else
+            echo "✗ ${REF} is NOT reachable from origin/develop — tag must be cut from develop"
+            exit 1
+          fi
+
+  test:
+    name: test (py${{ matrix.python }})
+    needs: guard-source-branch
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ['3.12', '3.13']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: pip
+      - run: python -m pip install --upgrade pip
+      - run: pip install -e ".[test,openai,anthropic,api,otel,mcp]" quantcrypt pymerkle
+      - name: run tests
+        # omit list + fail_under=80 come from [tool.coverage] in pyproject.toml
+        run: pytest --cov=src/hypermind --cov=src/hmctl -q
+
+  build:
+    name: build sdist + wheel
+    runs-on: ubuntu-latest
+    needs: test
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install --upgrade pip build twine
+      - run: python -m build
+      - run: twine check dist/*
+      - name: hash artifacts for cosign
+        id: hash
+        run: |
+          cd dist
+          echo "hashes=$(sha256sum * | base64 -w0)" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+          retention-days: 7
+
+  rust-hmctl:
+    name: build hmctl (${{ matrix.target }})
+    needs: guard-source-branch
+    if: startsWith(github.ref, 'refs/tags/v')
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: x86_64-unknown-linux-gnu
+            os: ubuntu-latest
+            artifact_name: hmctl-linux-amd64
+          - target: aarch64-unknown-linux-gnu
+            os: ubuntu-latest
+            artifact_name: hmctl-linux-arm64
+          - target: aarch64-apple-darwin
+            os: macos-14
+            artifact_name: hmctl-darwin-arm64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - name: install aarch64 cross linker
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        run: sudo apt-get update && sudo apt-get install -y gcc-aarch64-linux-gnu
+      - name: cargo build --release
+        working-directory: rust
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+        run: cargo build --release --target ${{ matrix.target }} -p hmctl
+      - name: strip + stage binary
+        working-directory: rust
+        run: |
+          set -euo pipefail
+          BIN="target/${{ matrix.target }}/release/hmctl"
+          if [[ "${{ matrix.target }}" == "aarch64-unknown-linux-gnu" ]]; then
+            aarch64-linux-gnu-strip "$BIN"
+          else
+            strip "$BIN"
+          fi
+          mkdir -p ../dist-rust
+          cp "$BIN" "../dist-rust/${{ matrix.artifact_name }}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: dist-rust/${{ matrix.artifact_name }}
+          retention-days: 7
+
+  cosign:
+    name: cosign keyless sign
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: sigstore/cosign-installer@v3
+      - name: sign dist artifacts (keyless OIDC)
+        run: |
+          set -euo pipefail
+          for f in dist/*.whl dist/*.tar.gz; do
+            cosign sign-blob --yes --bundle "${f}.bundle" "${f}"
+          done
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/*.bundle
+          retention-days: 30
+
+  publish-pypi:
+    name: publish → PyPI
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hypermind
+    permissions:
+      id-token: write
+      attestations: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          attestations: true
+
+  github-release:
+    name: GitHub release
+    runs-on: ubuntu-latest
+    needs: [cosign, publish-pypi, rust-hmctl]
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: sigstore-bundles
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: hmctl-linux-amd64
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: hmctl-linux-arm64
+          path: dist/
+      - uses: actions/download-artifact@v4
+        with:
+          name: hmctl-darwin-arm64
+          path: dist/
+      - name: rename hmctl binaries + checksum
+        run: |
+          set -euo pipefail
+          cd dist
+          mv hmctl-linux-amd64 "hmctl-${{ github.ref_name }}-linux-amd64"
+          mv hmctl-linux-arm64 "hmctl-${{ github.ref_name }}-linux-arm64"
+          mv hmctl-darwin-arm64 "hmctl-${{ github.ref_name }}-darwin-arm64"
+          chmod +x hmctl-*
+          sha256sum hmctl-* > hmctl-checksums.txt
+      - name: create GitHub release and upload assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          TAG="${{ github.ref_name }}"
+          ASSETS=()
+          for f in dist/*.whl dist/*.tar.gz dist/*.bundle dist/hmctl-* dist/hmctl-checksums.txt; do
+            [[ -f "$f" ]] && ASSETS+=("$f")
+          done
+          gh release create "${TAG}" \
+            --title "HyperMind ${TAG}" \
+            --generate-notes \
+            "${ASSETS[@]}"
+
+  docker:
+    name: docker — hub.docker.com/openworkbench/hypermind
+    runs-on: ubuntu-latest
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: set up QEMU (multi-arch)
+        uses: docker/setup-qemu-action@v3
+
+      - name: set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: short sha
+        id: sha
+        run: echo "short=${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT"
+
+      - name: build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/Dockerfile
+          push: true
+          # arm64: quantcrypt skipped at install time (Ed25519-only mode); all other features work.
+          platforms: linux/amd64,linux/arm64
+          tags: |
+            openworkbench/hypermind:latest
+            openworkbench/hypermind:${{ github.ref_name }}
+            openworkbench/hypermind:${{ steps.sha.outputs.short }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

hypermind-2.0.0/.github/workflows/rust-ci.yml

@@ -0,0 +1,65 @@
+name: rust-ci
+
+on:
+  push:
+    branches: [develop, stage, release, main]
+    paths:
+      - 'rust/**'
+      - '.github/workflows/rust-ci.yml'
+  pull_request:
+    paths:
+      - 'rust/**'
+      - '.github/workflows/rust-ci.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rust-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: build + test + clippy + fmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy, rustfmt
+      - name: cache cargo registry + build
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            rust/target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('rust/Cargo.lock') }}
+      - name: cargo fmt --check
+        working-directory: rust
+        run: cargo fmt --all -- --check
+      - name: cargo clippy -D warnings
+        working-directory: rust
+        run: cargo clippy --workspace --all-targets --examples -- -D warnings
+      - name: cargo test
+        working-directory: rust
+        run: cargo test --workspace
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+      - name: install Python SDK (for conformance vector fixtures)
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[test]"
+      - name: verify conformance vectors are not stale (Python side)
+        run: python -m tests.conformance.generate_vectors --check
+      - name: cross-language FROST interop (Rust ⇄ Python)
+        run: python -m pytest tests/test_frost_rust_interop.py -v
+      - name: cross-language ML-DSA-65 composite interop (Rust ⇄ Python)
+        run: python -m pytest tests/test_mldsa_rust_interop.py -v
+      - name: live TCP gossip federation (Rust ⇄ Python, real sockets)
+        run: python -m pytest tests/test_tcp_transport_rust_interop.py -v
+      - name: two-implementation wire-format interop (SDK ⇄ reference_verifier ⇄ Rust)
+        run: python -m pytest tests/test_two_impl_interop.py -v

hypermind-2.0.0/.gitignore

@@ -0,0 +1,161 @@
+# =============================================================================
+# .gitignore — hypermind-specs
+# Organised by category. Keep entries alphabetised within each section.
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Secrets, credentials, certificates
+# (NEVER commit these — even for tests, generate at runtime via fixtures)
+# -----------------------------------------------------------------------------
+*.crt
+*.key
+*.keystore
+*.p12
+*.pem
+*.pfx
+.env
+.env.*
+!.env.example
+credentials.json
+credentials.yaml
+credentials.yml
+secrets.json
+secrets.yaml
+secrets.yml
+
+# -----------------------------------------------------------------------------
+# Private working notes / internal-only directories
+# Per CLAUDE.md: docs/expert-panel/ is internal review notes, never public.
+# -----------------------------------------------------------------------------
+docs/expert-panel/
+notes/
+private/
+scratch/
+.scratch/
+TODO.private.md
+*.private.md
+
+# -----------------------------------------------------------------------------
+# AI / agent / coding-assistant working dirs
+# -----------------------------------------------------------------------------
+.aider*
+.claude/
+.codebase/
+.cursor/
+.vibekit/
+CLAUDE.local.md
+
+# -----------------------------------------------------------------------------
+# IDE / editor state
+# -----------------------------------------------------------------------------
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# -----------------------------------------------------------------------------
+# OS metadata
+# -----------------------------------------------------------------------------
+.DS_Store
+._*
+Thumbs.db
+desktop.ini
+
+# -----------------------------------------------------------------------------
+# Python — bytecode, caches, virtualenvs
+# -----------------------------------------------------------------------------
+__pycache__/
+*.py[cod]
+*$py.class
+.Python
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.tox/
+.venv/
+env/
+venv/
+
+# -----------------------------------------------------------------------------
+# Python — build / distribution artefacts
+# -----------------------------------------------------------------------------
+*.egg
+*.egg-info/
+.eggs/
+build/
+dist/
+pip-wheel-metadata/
+wheels/
+sdist/
+share/python-wheels/
+
+# -----------------------------------------------------------------------------
+# Coverage / test reports
+# -----------------------------------------------------------------------------
+.coverage
+.coverage.*
+coverage.json
+coverage.xml
+htmlcov/
+nosetests.xml
+.hypothesis/
+
+# -----------------------------------------------------------------------------
+# Lock files (project policy: pip-compile locks regenerated locally, not tracked)
+# -----------------------------------------------------------------------------
+requirements-dev.lock
+requirements.lock
+
+# -----------------------------------------------------------------------------
+# Logs, dumps, core files
+# -----------------------------------------------------------------------------
+*.dump
+*.log
+core.*
+
+# -----------------------------------------------------------------------------
+# Fuzzing corpora & crashes (corpora regenerated locally)
+# -----------------------------------------------------------------------------
+fuzz/corpus/
+fuzz/crashes/
+# AI context manifest
+.codebase.json
+.codebase.cache.json
+
+# SimLab — Vue webui
+webui/node_modules/
+webui/dist/
+# src/hypermind/simlab/ui/dist/  # ponytail: committed as pre-built artifact shipped with package
+
+# Stray scenario artifacts (output goes to ~/.hypermind/sims/ now)
+persona_audit.jsonl
+persona_trace.json
+.mcp.json
+trace.json
+
+# -----------------------------------------------------------------------------
+# Local runtime data — never commit server state.
+# `.data/` is the canonical docker-compose mount location; `data/` is legacy.
+# -----------------------------------------------------------------------------
+.data/
+data/
+data/relata/
+
+# Benchmark run artefacts (large raw traces). Slim traces + report.html kept locally.
+experiments/output/
+
+# Local scratch experiments (reports, benchmarks) — not shipped
+experiments/
+
+# mkdocs build output
+site/
+
+# Local MCP config (may contain secrets — edit deploy/mcp.example.toml instead)
+config/mcp.toml
+
+# -----------------------------------------------------------------------------
+# Rust port (rust/) — build artefacts only; Cargo.lock IS committed (workspace
+# ships a binary crate, hmctl)
+# -----------------------------------------------------------------------------
+rust/target/