hypermind 2.2.1__tar.gz → 2.4.0__tar.gz

{hypermind-2.2.1 → hypermind-2.4.0}/.gitignore

@@ -134,6 +134,9 @@ persona_trace.json
 .mcp.json
 trace.json
 
+# `hmctl show -o` — generated canvas artifact (serve mode writes no files)
+hypermind-network.html
+
 # -----------------------------------------------------------------------------
 # Local runtime data — never commit server state.
 # `.data/` is the canonical docker-compose mount location; `data/` is legacy.
@@ -152,8 +155,8 @@ experiments/
 site/
 
 # Local MCP config (may contain real tokens — setup.sh writes these from user input)
-config/mcp.toml
-config/mcp.json
+**/config/mcp.toml
+**/config/mcp.json
 
 # -----------------------------------------------------------------------------
 # Rust port (rust/) — build artefacts only; Cargo.lock IS committed (workspace

hypermind-2.4.0/.gitleaksignore

@@ -0,0 +1,7 @@
+# Gitleaks false positives — documentation placeholders, not real secrets.
+# The curl-auth-header rule fires on the literal `sk-your-key` placeholder in
+# the deploy troubleshooting docs. Fixed at HEAD (env-var references now);
+# these fingerprints cover the two occurrences in history (commit 6cb2ff1)
+# that the full-history push scan still reports.
+6cb2ff17366b511c3992e9186763817040df7ba3:docs/deploy/troubleshooting.md:curl-auth-header:255
+6cb2ff17366b511c3992e9186763817040df7ba3:docs/deploy/troubleshooting.md:curl-auth-header:259

{hypermind-2.2.1 → hypermind-2.4.0}/CHANGELOG.md

@@ -14,14 +14,127 @@ changes only on major-version bumps.
 
 ## [Unreleased]
 
+## [2.4.0] — 2026-08-24
+
 ### Added
-- **Single-container streamable-HTTP MCP gateway (#1013).** `deploy/Dockerfile.mcp-http`
-  + `deploy/docker-compose.mcp-http.yml` front `hmctl mcp serve` with
-  [`supergateway`](https://github.com/supercorp-ai/supergateway), exposing a
-  plain streamable-HTTP `/mcp` endpoint for platform integrations (gateway-style
-  tool discovery services) that don't speak raw TCP/SSE. Safe-by-default posture
-  matches `deploy/Dockerfile.mcp`: write mode on by default, `MCP_WRITE=0` for
-  read-only. Documented in `deploy/README.md`.
+- **`hmctl show` — live network canvas (`hypermind.viz`).** A read-only
+  infinite-canvas dashboard of the swarm: graph (pan/zoom, community halos,
+  per-agent detail drawer), agents table with reputation meters and outcome
+  sparklines, conversation stream, claims, disputes (FSM badges + transition
+  history), research artefacts, and a timeline scrubber that replays how the
+  network evolved. Two modes from one renderer: **serve live** (the new
+  default — `hmctl show` starts a loopback-only HTTP server on
+  `127.0.0.1:8791`, opens the browser, and the page polls a fresh snapshot
+  every `--interval` seconds, re-rendering in place with a live/reconnecting
+  chip) and **static artifact** (`-o file.html` — a fully self-contained
+  page with zero network code, safe to share or archive as audit evidence).
+  Sources, in priority order: `--relata-url` + `--namespace` (live Relata
+  ledger), a `hmctl orgs simulate --export` JSONL bundle (re-read whenever
+  the file changes on disk), `RELATA_URL` from the environment or
+  `~/.hypermind/env` (the hands-free default once `hmctl setup` has run),
+  or `--demo` (a zero-dependency in-process demo swarm). Re-running
+  `hmctl show` while a previous one is serving just re-opens the page.
+  Untrusted text (findings, reasons, statements) reaches the DOM via
+  `textContent` only — never `innerHTML`.
+- **Ledger tenancy onboarding: `hmctl setup` + `hypermind.storage.tenancy`.**
+  Closes the onboarding gap where a fresh Relata deployment + `hmctl mcp
+  install` pointed at a tenant nobody ever created (Relata never auto-creates
+  tenants on first `X-Organization-Id`; the namespace↔tenant mapping is 1:1).
+  New `hypermind.storage.tenancy` module: `ensure_tenant()` (idempotent
+  create; 409 = already exists; 404/501 = server build without a tenant admin
+  API → `X-Organization-Id` label scoping, still supported), `probe_key_role()`
+  (admin / tenant / invalid / unknown), `verify_ledger()` (read-only
+  reachable → tenant → Hm\* types → key check), `bootstrap_ledger()` (ensure
+  tenant + register the four Hm types via the existing #192 provisioning path
+  + verify). New `hmctl setup` command with three paths: **adopt** (deployment
+  already bootstrapped — verify + persist the tenant key), **elevate**
+  (supply an admin key once: create tenant, register types, then persist the
+  daily key), **local** (`--local`: SQLite ledger, zero network). Everything
+  is idempotent.
+- **Admin/master key handling contract (`hmctl setup`).** The admin key is
+  never read from the environment — `--admin-key` flag or hidden prompt only,
+  held in memory for exactly the privileged calls, and never persisted. A
+  master key handed in as `--key` is probed on the server, detected, warned
+  about, rerouted to the bootstrap path, and *not* written to
+  `~/.hypermind/env` unless the operator explicitly consents
+  (`--allow-admin-key`). Keys are echoed as SHA-256 fingerprints only, never
+  in full.
+- **`hmctl mcp serve --namespace`** — binds the swarm and the Relata tool
+  provider to one ledger tenant (they are 1:1). Also read from
+  `HYPERMIND_RELATA_NAMESPACE` (which `hmctl setup` writes) and from the
+  `namespace` key of the TOML config. The startup banner now shows the
+  active tenant.
+- **`hmctl mcp install` harvests ledger tenancy.** `RELATA_TOKEN` and
+  `HYPERMIND_RELATA_NAMESPACE` join the auto-harvested env vars, sourced from
+  the current shell first and `~/.hypermind/env` second — the tenant + token
+  `hmctl setup` chose now reach host-launched MCP servers, which start with a
+  blank environment.
+- **`hmctl doctor` ledger checks.** When `RELATA_URL` is configured, doctor
+  verifies the chain `hmctl setup` establishes — server reachable → tenant →
+  Hm\* types registered → `RELATA_TOKEN` accepted — with fix hints pointing
+  at `hmctl setup`. Unset `RELATA_URL` reports "local mode" instead.
+- **`hmctl/envfile.py`** — merge-preserving writer for `~/.hypermind/env`
+  (always mode 0600; unknown keys, comments, and ordering survive rewrites).
+  `hmctl config` now uses it, so keys written by `hmctl setup` (or by hand)
+  are no longer clobbered when the wizard re-saves; the wizard also prompts
+  for `RELATA_TOKEN` / `HYPERMIND_RELATA_NAMESPACE` and displays them in its
+  status table.
+
+### Fixed
+- **`RelataBackend` reads survive real-server row quirks** (found by live
+  validation against a fresh Relata deployment, 2026-08-24):
+  `load_claims()` no longer crashes with `KeyError('wire_b64')` on the
+  internal `_sentinel` objects server builds keep in the `HmClaim` table —
+  every restore path (`attach_storage()`, `hmctl show --relata-url`,
+  `from_relata()`) was affected. The claim, stub, dispute, and reputation
+  loaders now `SELECT *` and project client-side: some Relata builds
+  intermittently return a tiny subset of rows (or none) for multi-column
+  projections while `SELECT *` returns them all, which silently dropped
+  disputes and, on some calls, every claim from ledger-sourced snapshots.
+  Regression-pinned in `tests/test_storage_relata_sentinels.py`.
+
+## [2.3.0] — 2026-07-31
+
+Bundles the four epics from the "swarm can research a topic end-to-end"
+effort: web page/PDF discovery gaps, storage alignment with RelataDB, and
+making PI-decomposed swarms genuinely goal/objective-driven. Additive,
+backward-compatible — all new parameters default to prior behavior.
+
+### Added
+- **PDF fetch + site crawl for the research swarm (#1018).** `fetch_page`'s
+  Content-Type: application/pdf is no longer silently skipped/garbled — it
+  routes through pypdf extraction, shared with the local-file ingest path
+  (`hypermind.ingest._extract_pdf_bytes`). New `crawl_site` tool
+  (`orgs/web_crawl.py`): SSRF-validated BFS crawl of same-domain links,
+  hard-capped at 15 pages / depth 4 (default 5/2), covers HTML and PDFs.
+- **RelataDB `document_ingest` alignment (#1019).** `hypermind.ingest` gained
+  `ExtractedChunk`/`DocumentManifest`/`chunk_to_manifest()`/`to_jsonl()` —
+  a shared chunk/manifest shape matching RelataDB's datagrep extractor
+  protocol (section_path breadcrumbs, page numbers, chunking metadata).
+  `StorageBackend` gained `ingest_document()`/`search_chunks()`:
+  `RelataBackend` wraps the `relata` SDK's native `RelataClient.ingest_document()`;
+  `SqliteBackend` mirrors it locally (`intel_reports`/`intel_chunks` tables +
+  FTS5 index) so ingested documents are searchable without a Relata server.
+  `OrgSim(ingest_via_manifest=True)` (opt-in, default off) lands
+  `ingest_dir=` files this way in addition to the existing claim-publish path.
+- **Goal-driven charter-decomposed swarms (#1020).** `charter.py` gained
+  `plan_target_confidences()`; `OrgSim(unit_goal_confidence=...)` +
+  `DynamicsConfig(mode="deliberator")` let a PI-decomposed swarm
+  (`build_expert_model()`) stop via real goal satisfaction (per-sub-area
+  confidence + synthesis published) instead of only a fixed/converging round
+  count — bridges `charter.py`'s decomposition to the existing
+  `mind.goals`/`Deliberator` machinery. Fixed a latent bug in the
+  `goal_satisfied` early-exit: the coordination unit's (PI oracle +
+  Synthesist) own goal is now excluded from the AND-gate and synthesis is
+  checked via a published claim instead, since that goal has no defined
+  relationship to whether the sub-area experts finished.
+- **Intra-expert research probe gate (#1021).** `_think()` nudges (never
+  filters) the model away from re-researching a sub-area already backed by a
+  healthy density of confirmed facts, via a new `research_hint` on
+  `default_context_builder`. Tunable via `HYPERMIND_KNOWLEDGE_PROBE_THRESHOLD`
+  / `HYPERMIND_KNOWLEDGE_PROBE_MIN_FACTS`.
+
+## [2.2.1] — 2026-07-29
 
 ### Security
 - **CAP_REVOKE now gossips (#943 Phase 1).** A signed `CapRevocationRecord`
@@ -72,6 +185,13 @@ changes only on major-version bumps.
   module docstring for the full scoping rationale.
 
 ### Added
+- **Single-container streamable-HTTP MCP gateway (#1013).** `deploy/Dockerfile.mcp-http`
+  + `deploy/docker-compose.mcp-http.yml` front `hmctl mcp serve` with
+  [`supergateway`](https://github.com/supercorp-ai/supergateway), exposing a
+  plain streamable-HTTP `/mcp` endpoint for platform integrations (gateway-style
+  tool discovery services) that don't speak raw TCP/SSE. Safe-by-default posture
+  matches `deploy/Dockerfile.mcp`: write mode on by default, `MCP_WRITE=0` for
+  read-only. Documented in `deploy/README.md`.
 - **Bi-temporal recall + cross-namespace citation resolution (#942, L3
   follow-up).** `confirmed_hypotheses` entries carried no real timestamp
   before this — only `created_round`, a simulation round index, not a

{hypermind-2.2.1 → hypermind-2.4.0}/CLAUDE.md

@@ -36,7 +36,7 @@ Activate the venv first; everything assumes Python 3.12–3.14 (`requires-python
 .venv/bin/pip install -e ".[test,dev]"
 
 # Run the full suite (always run before commit)
-.venv/bin/python -m pytest -q                                      # ~4476 passing in ~90s
+.venv/bin/python -m pytest -q                                      # ~5093 passing in ~90s
 .venv/bin/python -m pytest --cov=src/hypermind --cov=src/hmctl     # coverage report
 
 # Run a single test
@@ -139,7 +139,7 @@ The living-simulation + research engine (spec: `docs/spec/20-swarm-intelligence.
 - `replay.py` — `export_jsonl` dumps every record (signed claims as wire bytes + disputes/reputation/evidence/hypotheses); `replay_to_relata` re-inserts a run **without re-running the LLM work**.
 - `sim.stream()` / `select_experts()` — streaming **tools-off** query over learned knowledge; consults a panel ranked by `hits × (1 + 0.7×rep + 0.3×fact_richness)`; `model=`/`client=` enable **learn-large / serve-small**. `_fact_richness()` is a log-damped ratio of confirmed/total facts for the expert's topic.
 - `tool_providers.py` / `mcp_config.py` — per-cycle tool gateway + MCP auto-discovery. `distributed/` — TCP master/worker for horizontal scale. `templates/` — preset org factories.
-- **Storage**: real `RelataBackend` (typed HmClaim/HmDispute/HmReputation) + `RelataMemoryStore` (evidence + hypotheses). Provision the Hm types once (admin token) — see `deploy/relata-serve.sh`. Multi-node federation is real over `transport/tcp.py::TCPGossipBus`.
+- **Storage**: real `RelataBackend` (typed HmClaim/HmDispute/HmReputation) + `RelataMemoryStore` (evidence + hypotheses). Provision the tenant + Hm types once via `hmctl setup` (admin key is prompted, never env-read — see `storage/tenancy.py`); `deploy/relata-serve.sh` / hypermind-deploy's `scripts/bootstrap-ledger.sh` do the same for scripted deployments. Multi-node federation is real over `transport/tcp.py::TCPGossipBus`.
 
 ### Other production modules
 
@@ -250,9 +250,9 @@ When changing a public verb, check that every example in `examples/` still runs
 
 ## Active milestone
 
-As of 2026-07-27, the SDK is at **2.1.5** on the **engineering GA** line (engineering GA shipped 2026-07-09 as 1.0.0; SemVer is binding). The protocol core, the full swarm-intelligence / mind layer, the `hypermind.orgs` deep-research engine (decomposition + self-refine, reasoning strategies + structured outcome parsing, hypothesis lifecycle with prediction-matching, architecture-native metrics, evidence retention + citations, cross-sim learned-fit persistence via KernelStore, streaming query, full-run replay, real Relata ledger + TCP federation), and the independent Rust second-language port (`rust/`) have all landed. Remaining gates are **ecosystem, not code** — IETF I-D submission, IANA early-allocation, OpenSSF Sandbox/Incubating acceptance, third-party security audit, full Tamarin/ProVerif proofs, NLnet/Alpha-Omega awards, ≥2 non-ZySec maintainers, ≥3 pilot MOUs, 7-day chaos-test green run, side-channel CT 30d-green. See [`docs/project/roadmap.md`](docs/project/roadmap.md) for item-numbered status.
+As of 2026-08-24, the SDK is at **2.4.0** on the **engineering GA** line (engineering GA shipped 2026-07-09 as 1.0.0; SemVer is binding). The protocol core, the full swarm-intelligence / mind layer, the `hypermind.orgs` deep-research engine (decomposition + self-refine, reasoning strategies + structured outcome parsing, hypothesis lifecycle with prediction-matching, architecture-native metrics, evidence retention + citations, cross-sim learned-fit persistence via KernelStore, streaming query, full-run replay, real Relata ledger + TCP federation, PDF/site-crawl discovery + RelataDB `document_ingest` alignment, goal-driven charter-decomposed swarms), and the independent Rust second-language port (`rust/`) have all landed. Remaining gates are **ecosystem, not code** — IETF I-D submission, IANA early-allocation, OpenSSF Sandbox/Incubating acceptance, third-party security audit, full Tamarin/ProVerif proofs, NLnet/Alpha-Omega awards, ≥2 non-ZySec maintainers, ≥3 pilot MOUs, 7-day chaos-test green run, side-channel CT 30d-green. See [`docs/project/roadmap.md`](docs/project/roadmap.md) for item-numbered status.
 
-> **Recent releases.** v2.0.0 (SemVer-major consolidation: wire-version 3 supported, deprecated-API removal, libp2p first-class transport binding, TAL v0.2 wire messages, Sealed/Citeable lattice, second-language port in progress). v2.1.0–v2.1.5 (2026-07-27): Rust port landed (`rust/`), L1–L5 autonomy stack, FTS5 storage, MoA endpoint, IEEE-defensible eval benchmark, dark-theme HTML report. The 2026-07-25 security-hardening fixes (issues #839-#844) shipped in 2.0 Phase 0. See [`CHANGELOG.md`](CHANGELOG.md) and [`docs/project/v2.0-plan.md`](docs/project/v2.0-plan.md).
+> **Recent releases.** v2.0.0 (SemVer-major consolidation: wire-version 3 supported, deprecated-API removal, libp2p first-class transport binding, TAL v0.2 wire messages, Sealed/Citeable lattice, second-language port in progress). v2.1.0–v2.1.5 (2026-07-27): Rust port landed (`rust/`), L1–L5 autonomy stack, FTS5 storage, MoA endpoint, IEEE-defensible eval benchmark, dark-theme HTML report. v2.2.0 (2026-07-28): autonomy pass (#983) — SSRF redirect/hostname hardening, deployment `profiles`, `coevolution`, `silent_failures`/`health`, `reputation_store`, `CachingResponder`/`DifficultyRouter`, hybrid SQLite search, active grounding gates (defaults changed, API-compatible). v2.2.1 (2026-07-29): CAP_REVOKE gossip + canonical-CBOR gate (#943 P1), TAL v0.2 signed wire messages (#943 P2), bi-temporal recall + cross-namespace Merkle citation proofs (#942), streamable-HTTP MCP gateway (#1013). v2.3.0 (2026-07-31): PDF/site-crawl discovery (#1018), RelataDB `document_ingest` alignment (#1019), goal-driven charter swarms (#1020), intra-expert research probe gate (#1021). v2.4.0 (2026-08-24): `hmctl show` live network canvas (`hypermind.viz`), ledger tenancy onboarding (`hmctl setup` + `hypermind.storage.tenancy`), admin-key handling contract, `mcp serve --namespace`, doctor ledger checks, live-validated Relata read fixes (sentinel rows, projection quirk). The 2026-07-25 security-hardening fixes (issues #839-#844) shipped in 2.0 Phase 0. See [`CHANGELOG.md`](CHANGELOG.md) and [`docs/project/v2.0-plan.md`](docs/project/v2.0-plan.md).
 
 > **Note on doc locations (2026-07-25):** `CHARTER.md`, `GOVERNANCE.md`, `MAINTAINERS.md`, `ROADMAP.md`, and `REPO_MAP.md` were moved from the repo root into [`docs/project/`](docs/project/) (renamed lowercase). Root retains only the GitHub platform files (`README`, `LICENSE`, `SECURITY`, `CODE_OF_CONDUCT`, `CONTRIBUTING`, `CHANGELOG`, `CODEOWNERS`) plus `CLAUDE.md`. See [`docs/INDEX.md`](docs/INDEX.md) for the full doc map.
 

{hypermind-2.2.1 → hypermind-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: hypermind
-Version: 2.2.1
+Version: 2.4.0
 Summary: Federated agent intelligence — reference SDK for the HyperMind SCITT contested-claims profile
 Project-URL: Homepage, https://github.com/ZySec-AI/hypermind
 Project-URL: Documentation, https://github.com/ZySec-AI/hypermind/tree/main/docs
@@ -90,8 +90,8 @@ Agents share what they learn, dispute what they doubt, and build reputation over
 [![PyPI](https://img.shields.io/pypi/v/hypermind?color=4c8cff&label=pip%20install%20hypermind)](https://pypi.org/project/hypermind/)
 [![Python](https://img.shields.io/pypi/pyversions/hypermind?color=4c8cff)](https://pypi.org/project/hypermind/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE)
-[![Tests](https://img.shields.io/badge/tests-4476-brightgreen)](#status)
-[![Version](https://img.shields.io/badge/version-2.1.5-blue)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-5093-brightgreen)](#status)
+[![Version](https://img.shields.io/badge/version-2.4.0-blue)](CHANGELOG.md)
 
 **[Quickstart](#quickstart-30-seconds)** ·
 **[MCP tools](#mcp-tools-63-tools)** ·
@@ -128,6 +128,7 @@ hits = await hm.retrieve("key size", min_trust=0.6)                 # → trust-
 ```bash
 hmctl mcp install          # auto-wires the host (read-only by default; --write to publish)
 hmctl mcp install --local  # fully offline: Ollama auto-detect + SQLite ledger, no API key
+hmctl setup                # using a Relata ledger? one command: tenant + types + key, verified
 ```
 
 Then just talk naturally — *"What does the swarm know about CRISPR off-target effects?"*,
@@ -337,6 +338,7 @@ hmctl ingest notes.md --topic research # ingest documents into the swarm
 hmctl dataset export --format dpo --out dpo.jsonl   # export fine-tuning dataset
 hmctl population create my-lab --template research_lab --size 5
 hmctl eval                             # run the calibration metric suite
+hmctl show                             # live network canvas (serve + auto-open; -o out.html for a static artifact)
 hmctl orgs simulate --template university --topic "…" --rounds 6 --live
 hmctl doctor                           # smoke-test the install
 ```
@@ -378,7 +380,7 @@ hmctl mcp install # wires Claude Desktop/Cursor + auto-adds fetch/Serper/SearchA
 
 ## Status
 
-**Engineering GA** (1.0.0, 2026-07-09; SemVer binding). Current release: **2.1.5** (2026-07-27).
+**Engineering GA** (1.0.0, 2026-07-09; SemVer binding). Current release: **2.4.0** (2026-08-24).
 Remaining gates are **ecosystem, not code** (see [roadmap](docs/project/roadmap.md) §External).
 
 - **Protocol** — 33 numbered spec sections (§00–§32) + independent [`reference_verifier/`](reference_verifier/) proving two-impl interop + second-language [`rust/`](rust/) port (v2.1.0)

{hypermind-2.2.1 → hypermind-2.4.0}/README.md

@@ -12,8 +12,8 @@ Agents share what they learn, dispute what they doubt, and build reputation over
 [![PyPI](https://img.shields.io/pypi/v/hypermind?color=4c8cff&label=pip%20install%20hypermind)](https://pypi.org/project/hypermind/)
 [![Python](https://img.shields.io/pypi/pyversions/hypermind?color=4c8cff)](https://pypi.org/project/hypermind/)
 [![License](https://img.shields.io/badge/license-Apache--2.0-green.svg)](LICENSE)
-[![Tests](https://img.shields.io/badge/tests-4476-brightgreen)](#status)
-[![Version](https://img.shields.io/badge/version-2.1.5-blue)](CHANGELOG.md)
+[![Tests](https://img.shields.io/badge/tests-5093-brightgreen)](#status)
+[![Version](https://img.shields.io/badge/version-2.4.0-blue)](CHANGELOG.md)
 
 **[Quickstart](#quickstart-30-seconds)** ·
 **[MCP tools](#mcp-tools-63-tools)** ·
@@ -50,6 +50,7 @@ hits = await hm.retrieve("key size", min_trust=0.6)                 # → trust-
 ```bash
 hmctl mcp install          # auto-wires the host (read-only by default; --write to publish)
 hmctl mcp install --local  # fully offline: Ollama auto-detect + SQLite ledger, no API key
+hmctl setup                # using a Relata ledger? one command: tenant + types + key, verified
 ```
 
 Then just talk naturally — *"What does the swarm know about CRISPR off-target effects?"*,
@@ -259,6 +260,7 @@ hmctl ingest notes.md --topic research # ingest documents into the swarm
 hmctl dataset export --format dpo --out dpo.jsonl   # export fine-tuning dataset
 hmctl population create my-lab --template research_lab --size 5
 hmctl eval                             # run the calibration metric suite
+hmctl show                             # live network canvas (serve + auto-open; -o out.html for a static artifact)
 hmctl orgs simulate --template university --topic "…" --rounds 6 --live
 hmctl doctor                           # smoke-test the install
 ```
@@ -300,7 +302,7 @@ hmctl mcp install # wires Claude Desktop/Cursor + auto-adds fetch/Serper/SearchA
 
 ## Status
 
-**Engineering GA** (1.0.0, 2026-07-09; SemVer binding). Current release: **2.1.5** (2026-07-27).
+**Engineering GA** (1.0.0, 2026-07-09; SemVer binding). Current release: **2.4.0** (2026-08-24).
 Remaining gates are **ecosystem, not code** (see [roadmap](docs/project/roadmap.md) §External).
 
 - **Protocol** — 33 numbered spec sections (§00–§32) + independent [`reference_verifier/`](reference_verifier/) proving two-impl interop + second-language [`rust/`](rust/) port (v2.1.0)

{hypermind-2.2.1 → hypermind-2.4.0}/docs/INDEX.md

@@ -1,7 +1,7 @@
 # HyperMind documentation index
 
 > **One-page map** of every doc in `docs/` and the GitHub platform files at the
-> repo root. Last updated 2026-07-27. Rendered site nav lives in
+> repo root. Last updated 2026-07-31. Rendered site nav lives in
 > [`mkdocs.yml`](../mkdocs.yml); this page is the source of truth for *what each
 > doc is for*.
 
@@ -287,7 +287,7 @@ End-to-end docs for the one-command Docker deployment. Target: operators, app bu
 | File | Purpose |
 |---|---|
 | [`migrate/v0.x-to-v1.0.md`](migrate/v0.x-to-v1.0.md) | v0.x → v1.0 migration guide. |
-| [`release-notes/`](release-notes/) | One file per release (`v1.0.0.md` through `v1.11.0.md`). |
+| [`release-notes/`](release-notes/) | One file per release (`v1.0.0.md` through `v2.3.0.md`). |
 | [`paper/00-patent.md`](paper/00-patent.md) | Patent disclosure. |
 | [`paper/hypermind-paper-draft.md`](paper/hypermind-paper-draft.md) | Research-paper draft. |
 | [`simlab/modes.md`](simlab/modes.md) | SimLab mode reference. |

{hypermind-2.2.1 → hypermind-2.4.0}/docs/configuration.md

@@ -18,6 +18,53 @@ tuning knob in a formatted table.
 
 ---
 
+## Ledger onboarding (`hmctl setup`)
+
+When `RELATA_URL` points at a Relata deployment, claims live in a **tenant**
+— the Relata tenant the HyperMind namespace maps to, 1:1 (`HYPERMIND_RELATA_NAMESPACE`).
+Relata does not auto-create tenants, so a fresh deployment needs one round of
+onboarding before the SDK can persist anything:
+
+```bash
+hmctl setup                       # interactive: url, tenant, keys — verifies as it goes
+hmctl setup --admin-key … --key … # non-interactive elevate + adopt
+hmctl setup --local               # no Relata: SQLite ledger, zero network
+```
+
+Everything `hmctl setup` does is idempotent — re-running against a
+bootstrapped server is a no-op re-verify. Docker deployments bootstrapped by
+[hypermind-deploy](https://github.com/ZySec-AI/hypermind-deploy)'s
+`start.sh` only need the **adopt** path (verify + persist the tenant key).
+
+**Key model (security-relevant):**
+
+| Key | Scope | Where it lives |
+|---|---|---|
+| tenant / daily key | read + write on one tenant's data | `RELATA_TOKEN` in `~/.hypermind/env` |
+| admin / master key | tenant creation, type registration | **nowhere** — prompted or `--admin-key`, used once in memory |
+
+The admin key is never read from the environment and never persisted by the
+SDK. If a master key is passed as the daily key (`--key`), `hmctl setup`
+probes its actual role on the server, warns that it is over-privileged,
+uses it ephemerally for bootstrap, and refuses to persist it without
+explicit consent (`--allow-admin-key`). Keys are displayed as SHA-256
+fingerprints only.
+
+`hmctl doctor` re-checks the chain on every run: server reachable → tenant →
+Hm\* types registered → token accepted, with fix hints pointing back at
+`hmctl setup`.
+
+**Tenant data isolation is a server-side guarantee.** The SDK sends
+`X-Organization-Id` on every request and namespace-filters reputation rows it
+reads, but query-result scoping is enforced by Relata, not the client. On the
+free Relata profile (verified live 2026-08-24) all tenants' rows are returned
+to every tenant — onboarding still works, but tenants on such a build share
+one data plane. Enforce isolation at the Relata tier (licensed profile or a
+Relata build with row-level org scoping) before relying on it for
+multi-tenant deployments.
+
+---
+
 ## LLM / Responder
 
 | Variable | Default | Description |
@@ -46,7 +93,7 @@ tuning knob in a formatted table.
 | `RELATA_BEARER_TOKEN` | *(none)* | Bearer token for authenticating requests to RelataDB. Also accepted as `RELATA_TOKEN`. Required when the RelataDB instance is protected by token auth (e.g. managed cloud deployments). Source: `src/hypermind/integrations/client.py`. |
 | `RELATA_TOKEN` | *(none)* | Alias for `RELATA_BEARER_TOKEN` (checked as fallback). |
 | `RELATA_MCP_PURPOSE` | `intops` | Purpose tag stamped on claims written through the MCP server. Legacy alias `RELATA_PURPOSE` is also accepted. Source: `src/hypermind/config.py`. |
-| `HYPERMIND_RELATA_NAMESPACE` | `hypermind` | Relata tenant namespace shared across SDK paths (client, OrgSim, MCP server). Per-org namespaces are sub-scoped as `<tenant>:<org>` inside this tenant. Source: `src/hypermind/config.py`. |
+| `HYPERMIND_RELATA_NAMESPACE` | `hypermind` | Relata tenant namespace shared across SDK paths (client, OrgSim, `mcp serve`). Per-org namespaces are sub-scoped as `<tenant>:<org>` inside this tenant. Written by `hmctl setup`; `hmctl mcp serve --namespace` overrides per-launch. Source: `src/hypermind/config.py`. |
 | `HYPERMIND_DB` | `~/.hypermind/cache.db` | Path to the local SQLite cache database. Auto-activated when `RELATA_URL` is not set. Persists claims, agent state, and hypothesis records across restarts. |
 | `HYPERMIND_STORAGE` | *(auto)* | Force a storage backend: `relata` or `sqlite`. When unset the SDK selects `relata` if `RELATA_URL` is present, otherwise `sqlite`. Source: `src/hypermind/storage/__init__.py`. |
 | `HYPERMIND_NAMESPACE` | *(sandbox default)* | Default namespace ID used when creating the storage backend. Source: `src/hypermind/storage/__init__.py`. |
@@ -443,7 +490,8 @@ The `hm-moa` model on the OpenAI-compatible endpoint is configured via the `HYPE
 ## See also
 
 - `hmctl env-vars` — print a live table of all tuning knobs with current values
-- `hmctl doctor` — health-check that reports `HYPERMIND_SSE_PORT`, `HYPERMIND_WEBHOOK_PORT`, and `HYPERMIND_WEBHOOK_SECRET` status
+- `hmctl setup` — one-command ledger onboarding: ensure tenant, register Hm\* types, verify, persist the daily key
+- `hmctl doctor` — health-check that reports `HYPERMIND_SSE_PORT`, `HYPERMIND_WEBHOOK_PORT`, `HYPERMIND_WEBHOOK_SECRET`, and (when `RELATA_URL` is set) the ledger tenant/types/token chain
 - `hmctl config` — interactive wizard for setting the most common variables
 - `hmctl status` — shows LLM, Relata, web search backend, MCP servers, and what to fix
 - [docs/integrations.md](integrations.md) — integration guide and advanced tuning knobs

{hypermind-2.2.1 → hypermind-2.4.0}/docs/decide/01-disqualifiers.md

@@ -15,7 +15,7 @@ You should not adopt HyperMind v0 if any of these are true:
 - **All your agents share a database or trust domain.** Use A2A, MCP, or direct RPC.
 - **You cannot afford 4 GB RAM per agent process.** Use lite-tier only (reduced capability) or a different stack.
 - **You need source identity protection for people at physical risk.** Use Tor + SecureDrop; HyperMind only as a corroboration layer afterwards.
-- **You need a working library to import today.** Reference implementation has shipped: `pip install hypermind` (current: v2.1.5 on [PyPI](https://pypi.org/project/hypermind/); engineering GA landed 2026-07-09 as v1.0.0). See [`README.md`](../../README.md) §Quickstart.
+- **You need a working library to import today.** Reference implementation has shipped: `pip install hypermind` (current: v2.3.0 on [PyPI](https://pypi.org/project/hypermind/); engineering GA landed 2026-07-09 as v1.0.0). See [`README.md`](../../README.md) §Quickstart.
 - **Your team has under 6 months of distributed-systems experience.** Prototype only; do not ship to production.
 - **You need real-time response during high-stakes adversarial events** (elections, live conflict intelligence). The ~170-claim Sybil window and timing-analysis de-anonymization are disqualifying. See [../design/03-failure-modes.md](../design/03-failure-modes.md).
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/deploy/add-tool-provider.md

@@ -546,7 +546,7 @@ def handler(args: dict) -> str:
 
 **Set in `.env`:**
 ```
-MY_API_KEY=sk-your-key-here
+MY_API_KEY=<your-provider-key>
 ```
 
 ---

{hypermind-2.2.1 → hypermind-2.4.0}/docs/deploy/quickstart.md

@@ -49,7 +49,7 @@ The script will:
 HyperMind setup — press Enter to keep the shown default.
 
   RELATA_TOKEN (data-store auth) [existing-token-or-generated]: 
-  OPENAI_API_KEY [keep existing]: sk-your-key-here
+  OPENAI_API_KEY [keep existing]: <your-openai-key>
   OPENAI_BASE_URL [https://api.minimax.io/v1]: 
   HYPERMIND_LLM_MODEL [MiniMax-M3]: 
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/deploy/troubleshooting.md

@@ -251,13 +251,13 @@ Examples:
 
 **Step 4: Test provider is reachable**
 ```bash
-# From host
+# From host (exports your real key first: export OPENAI_API_KEY=...)
 curl https://api.openai.com/v1/models \
-  -H "Authorization: Bearer sk-your-key"
+  -H "Authorization: Bearer $OPENAI_API_KEY"
 
-# From inside container
+# From inside container (reads the key the container already has)
 docker exec hm-engine curl https://api.openai.com/v1/models \
-  -H "Authorization: Bearer sk-your-key"
+  -H "Authorization: Bearer \$OPENAI_API_KEY"
 ```
 
 If connection failed: Check firewall/proxy.

{hypermind-2.2.1 → hypermind-2.4.0}/docs/design/01-architecture.md

@@ -1,6 +1,6 @@
 # Architecture — what HyperMind is
 
-> **Status (2026-07-27):** This doc was written against the v0.x design intent (two-layer P2P sealing protocol with diverse-quorum confirmers, identity tiers, PoW/VDF admission). The shipped SDK at v2.1.5 has evolved substantially: it is an **async-first Python framework for federated agent reasoning** organised around the layers below. The "two-layer protocol" framing here is preserved for historical context and for the design-target sealing system documented in [`docs/paper/00-patent.md`](../paper/00-patent.md) Embodiments 4–5; for the shipped architecture see [`docs/spec/00-overview.md`](../spec/00-overview.md), the [mind layer spec §20](../spec/20-swarm-intelligence.md), and the [deep-research engine spec §31](../spec/31-deep-research-engine.md).
+> **Status (2026-07-31):** This doc was written against the v0.x design intent (two-layer P2P sealing protocol with diverse-quorum confirmers, identity tiers, PoW/VDF admission). The shipped SDK at v2.3.0 has evolved substantially: it is an **async-first Python framework for federated agent reasoning** organised around the layers below. The "two-layer protocol" framing here is preserved for historical context and for the design-target sealing system documented in [`docs/paper/00-patent.md`](../paper/00-patent.md) Embodiments 4–5; for the shipped architecture see [`docs/spec/00-overview.md`](../spec/00-overview.md), the [mind layer spec §20](../spec/20-swarm-intelligence.md), and the [deep-research engine spec §31](../spec/31-deep-research-engine.md).
 >
 > Read [../decide/01-disqualifiers.md](../decide/01-disqualifiers.md) and [../decide/03-incentive-aligned-cases.md](../decide/03-incentive-aligned-cases.md) before this page. If those did not disqualify you, here is the design.
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/design/02-traces.md

@@ -1,6 +1,6 @@
 # Protocol traces — message-level walkthroughs
 
-> **Status (2026-07-27):** **Mixed shipped + design-target.** Traces 1–5 describe the **design-target** sealing flow (ANNOUNCE → CONFIRM → SEAL with diverse-quorum confirmers and 200-claim correctness windows) — none of this ships in the SDK at v2.1.5; the shipped flow is `publish_claim → append_and_cosign → receipt` per [`src/hypermind/agent.py`](../../src/hypermind/agent.py) and [`src/hypermind/knowledge/transparency.py`](../../src/hypermind/knowledge/transparency.py). Traces 6–8 reference DESIGN-PARTIAL primitives. The traces remain useful as **intent for the post-v3.0 sealed/citeable lattice** (spec §04 §5.2 invariants); they should not be read as a description of what the SDK does today.
+> **Status (2026-07-31):** **Mixed shipped + design-target.** Traces 1–5 describe the **design-target** sealing flow (ANNOUNCE → CONFIRM → SEAL with diverse-quorum confirmers and 200-claim correctness windows) — none of this ships in the SDK at v2.3.0; the shipped flow is `publish_claim → append_and_cosign → receipt` per [`src/hypermind/agent.py`](../../src/hypermind/agent.py) and [`src/hypermind/knowledge/transparency.py`](../../src/hypermind/knowledge/transparency.py). Traces 6–8 reference DESIGN-PARTIAL primitives. The traces remain useful as **intent for the post-v3.0 sealed/citeable lattice** (spec §04 §5.2 invariants); they should not be read as a description of what the SDK does today.
 
 > These walkthroughs show the exact protocol message sequence for representative use cases. Every message type maps to a defined message in the [spec](../spec/00-overview.md). Timing figures are estimates on a healthy mesh — see [../operate/03-resource-budget.md](../operate/03-resource-budget.md) for the unmeasured-estimate caveat.
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/design/03-failure-modes.md

@@ -1,6 +1,6 @@
 # Failure modes — adversaries, equilibria, and collective-intelligence pathology
 
-> **Status (2026-07-27):** **Conceptual reference; not all failure modes have shipped defenses.** This page catalogues collective-intelligence failure modes (with and without adversaries). The mechanisms it informs — diverse-quorum sealing, 200-claim correctness windows, anchor-tenant capture pricing — are **design-target** for the post-v3.0 sealed/citeable lattice (spec §04 §5.2 invariants). The shipped SDK at v2.1.5 mitigates several of these failure modes via the Beta-posterior reputation kernel, the dispute FSM, capability tokens, and the cascaded-security L1–L5 model; the unshipped mechanisms remain accurate as intent.
+> **Status (2026-07-31):** **Conceptual reference; not all failure modes have shipped defenses.** This page catalogues collective-intelligence failure modes (with and without adversaries). The mechanisms it informs — diverse-quorum sealing, 200-claim correctness windows, anchor-tenant capture pricing — are **design-target** for the post-v3.0 sealed/citeable lattice (spec §04 §5.2 invariants). The shipped SDK at v2.3.0 mitigates several of these failure modes via the Beta-posterior reputation kernel, the dispute FSM, capability tokens, and the cascaded-security L1–L5 model; the unshipped mechanisms remain accurate as intent.
 
 > Read this before designing anything around HyperMind. These failure modes are not theoretical. They are the reason the protocol has the mechanisms it has — and the reason those mechanisms are insufficient in some categories.
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/design/04-poisoning-defenses.md

@@ -1,6 +1,6 @@
 # Poisoning defenses — innovations beyond §7.4 and the 03-failure-modes inventory
 
-> **Status (2026-07-27):** **Design proposals, not shipped.** None of the six defenses below are implemented in the SDK at v2.1.5, are referenced by a spec section, or are adopted by an ADR. They are tracked as design exploration for the post-v3.0 sealed/citeable lattice.
+> **Status (2026-07-31):** **Design proposals, not shipped.** None of the six defenses below are implemented in the SDK at v2.3.0, are referenced by a spec section, or are adopted by an ADR. They are tracked as design exploration for the post-v3.0 sealed/citeable lattice.
 
 > Read [03-failure-modes.md](03-failure-modes.md) first. This page proposes **new** defenses that address attacks the existing roster does not close. Each section names the specific failure-mode row it targets.
 >

{hypermind-2.2.1 → hypermind-2.4.0}/docs/design/05-deployment-topology.md

@@ -1,6 +1,6 @@
 # Reference Deployment Topology
 
-> **Status (2026-07-27):** **Design-target / forward-looking.** This document describes the deployment topology the spec targets *once* the IPFS / Iroh / libp2p-gossipsub substrate is integrated. As of SDK v2.1.5, **none of those dependencies ship in `pyproject.toml`**. The shipped transport is **TCP federation** (`TCPGossipBus`, per [ADR-0001](../adr/0001-tcp-federation-chosen-as-v1-transport.md)); storage is **SQLite (local) + Relata (federated)** per [ADR-0009](../adr/0009-dual-storage-backend-sqlite-local-default-and-relata-federated.md); **libp2p is the optional external binding** per [ADR-0003](../adr/0003-libp2p-deferred-to-optional-external-binding.md) and lives in `transport-rust/`. Treat the topology table below as the v3.0+ target, not the v2.x production shape. For the shipped shape see [`docs/operate/01-deployment.md`](../operate/01-deployment.md) and [`docs/operate/03-resource-budget.md`](../operate/03-resource-budget.md).
+> **Status (2026-07-31):** **Design-target / forward-looking.** This document describes the deployment topology the spec targets *once* the IPFS / Iroh / libp2p-gossipsub substrate is integrated. As of SDK v2.3.0, **none of those dependencies ship in `pyproject.toml`**. The shipped transport is **TCP federation** (`TCPGossipBus`, per [ADR-0001](../adr/0001-tcp-federation-chosen-as-v1-transport.md)); storage is **SQLite (local) + Relata (federated)** per [ADR-0009](../adr/0009-dual-storage-backend-sqlite-local-default-and-relata-federated.md); **libp2p is the optional external binding** per [ADR-0003](../adr/0003-libp2p-deferred-to-optional-external-binding.md) and lives in `transport-rust/`. Treat the topology table below as the v3.0+ target, not the v2.x production shape. For the shipped shape see [`docs/operate/01-deployment.md`](../operate/01-deployment.md) and [`docs/operate/03-resource-budget.md`](../operate/03-resource-budget.md).
 
 > HyperMind composes existing P2P primitives. Nothing below the SCITT envelope is reinvented.
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/feature-matrix.md

@@ -8,9 +8,13 @@ HyperMind SDK, the `hmctl` CLI, the independent `reference_verifier/`, and the
 second-language `rust/` port. A row exists for every shipped capability. The
 project reached **engineering GA at 1.0.0 (2026-07-09)**, followed by twelve
 1.x minor releases (1.1–1.12), the **v2.0.0 SemVer-major consolidation**
-(2026-07-25), and the **v2.1.x series** (2026-07-27) adding the Rust port,
+(2026-07-25), the **v2.1.x series** (2026-07-27) adding the Rust port,
 L1–L5 autonomy stack, FTS5 storage, MoA endpoint, and the IEEE-defensible eval
-benchmark. Remaining gates are ecosystem/foundation work (see
+benchmark, the **v2.2.0 autonomy pass** (#983: profiles, coevolution,
+hybrid search, responder routing/caching, active grounding gates) +
+**v2.2.1** (CAP_REVOKE gossip, TAL v0.2 wire, bi-temporal recall), and
+**v2.3.0** (site-crawl/PDF discovery, RelataDB `document_ingest` alignment,
+goal-driven charter swarms). Remaining gates are ecosystem/foundation work (see
 [roadmap.md](project/roadmap.md) §External), not code.
 
 ## Maintenance rules
@@ -471,4 +475,4 @@ historical surface still find a row.
 
 ---
 
-*Last updated: 2026-07-27. Version: 2.1.5. Test count: 4476 (per `pytest --collect-only -q`).*
+*Last updated: 2026-07-31. Version: 2.3.0. Test count: 5093 (per `pytest --collect-only -q`).*

{hypermind-2.2.1 → hypermind-2.4.0}/docs/integrations.md

@@ -206,7 +206,7 @@ ledger — no API key, no internet required.
 
 ### MCP tool reference (56 read-only / 63 writable tools)
 
-> **Note.** The mutating set is gated by `hmctl mcp install --write`. The exact count of read-only and mutating tools shifts slightly between releases as new tools are added; the canonical counts are emitted by `hmctl mcp install --dry-run`. README.md and CLAUDE.md cite the current totals (63 in write mode, 56 in read-only mode at v2.1.5).
+> **Note.** The mutating set is gated by `hmctl mcp install --write`. The exact count of read-only and mutating tools shifts slightly between releases as new tools are added; the canonical counts are emitted by `hmctl mcp install --dry-run`. README.md and CLAUDE.md cite the current totals (63 in write mode, 56 in read-only mode at v2.3.0).
 
 **Observability**
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/operate/01-deployment.md

@@ -1,9 +1,9 @@
 # Deployment — cold-start, anchor-tenant, HMAC custody, capability tokens
 
-> **Status (2026-07-27).** **Design-target.** None of the CLI commands in this doc
+> **Status (2026-07-31).** **Design-target.** None of the CLI commands in this doc
 > (`hypermind init`, `hypermind consult`, `hypermind join`, `hypermind rebuild`)
 > are runnable as written; they describe the intended developer experience for
-> the post-v3.0 sealed/citeable lattice. The shipped SDK at v2.1.5 uses `hmctl`
+> the post-v3.0 sealed/citeable lattice. The shipped SDK at v2.3.0 uses `hmctl`
 > (see [`docs/quickstart.md`](../quickstart.md) and `hmctl --help` for the actual
 > surface — `hmctl quickstart`, `hmctl serve-endpoint`, `hmctl mcp install`,
 > `hmctl ingest`, `hmctl dataset export`, `hmctl eval`, `hmctl orgs simulate`,

{hypermind-2.2.1 → hypermind-2.4.0}/docs/operate/data-residency.md

@@ -1,6 +1,6 @@
 # Data Residency
 
-> **Status (2026-07-27):** The shipped SDK at v2.1.5 uses **async TCP federation**
+> **Status (2026-07-31):** The shipped SDK at v2.3.0 uses **async TCP federation**
 > (`TCPGossipBus`) per [ADR-0001](../adr/0001-tcp-federation-chosen-as-v1-transport.md)
 > and is single-region by default. The libp2p binding is the **optional external
 > binding** per [ADR-0003](../adr/0003-libp2p-deferred-to-optional-external-binding.md)

{hypermind-2.2.1 → hypermind-2.4.0}/docs/operate/slo.md

@@ -1,9 +1,9 @@
 # Service-Level Objectives — Production Profile
 
-> **Status (2026-07-27).** **Design-target / forward-looking.** The SLOs below
+> **Status (2026-07-31).** **Design-target / forward-looking.** The SLOs below
 > were drafted against the post-v3.0 sealed/citeable lattice design (with
 > `publish_claim` quorum, sealing pipeline, 200-claim correctness window). The
-> shipped SDK at v2.1.5 has no sealing pipeline; `publish_claim()` lands claims
+> shipped SDK at v2.3.0 has no sealing pipeline; `publish_claim()` lands claims
 > directly in the transparency log via `append_and_cosign()`, so the
 > "Publish latency p99 < 250 ms" objective is trivially met in the absence of
 > quorum traffic. The "Partition-recovery MTTR < 90 s" objective depends on

{hypermind-2.2.1 → hypermind-2.4.0}/docs/paper/hypermind-paper-draft.md

@@ -335,7 +335,7 @@ The design rationale for the conjunction threshold is sound: legitimate reputati
 
 ### 5.1 Overview
 
-The HyperMind reference implementation is a Python SDK, version 2.1.5, supporting Python 3.12–3.14. The SDK collects over 4,476 tests under `pytest` at the time of writing. An independent Rust second-language implementation (`rust/`) shipped in v2.1.0 and is covered by cross-language interop tests.
+The HyperMind reference implementation is a Python SDK, version 2.3.0, supporting Python 3.12–3.14. The SDK collects over 5,093 tests under `pytest` at the time of writing. An independent Rust second-language implementation (`rust/`) shipped in v2.1.0 and is covered by cross-language interop tests.
 
 The test tree is organised by subsystem, with dedicated suites for the wire format (A-ALG-BOUND, WF-DOMAIN), the dispute FSM (I-DISPUTE-PARTITION, TAL-ESCROW-EXCLUSIVE), capability tokens (A-TOMB-REVOKE-DISJOINT and the parent-hash chain invariants), the reputation kernel (Beta posterior, vouch cap, calibration gate), the transparency log (A-SEAL-ATOMIC, receipt verification), the crypto modules (Ed25519, FROST, HLC, domain separation), the mind layer (swarm deliberation, roles, diversity metrics), the transport layer (`_seen` cache bound, anti-entropy Bloom validation), the conformance CLI, the harness scenarios, and integration paths exercised by the numbered `examples/` tutorials. Five numbered self-healing regression suites (`test_self_heal_cycle1.py` through `test_self_heal_cycle5.py`, with two cycle-3 and cycle-4 companion files for the cascade-isolate and deliberator-broadcast fixes) pin specific vulnerability fixes; per-cycle contents are described in §6.1. The two-implementation interop suite (`tests/test_two_impl_interop.py`) covers SDK ↔ `reference_verifier` agreement on wire-format edge cases. Exact per-suite counts shift between releases as new regressions land; the authoritative current figures are emitted by `pytest --collect-only` on the tagged release commit.
 

{hypermind-2.2.1 → hypermind-2.4.0}/docs/project/roadmap.md

@@ -10,9 +10,9 @@ Each milestone is **Python-only** (per the language-scope policy below). Second-
 
 ---
 
-## Status snapshot — 2026-07-26
+## Status snapshot — 2026-07-31
 
-**Working version:** `2.1.5` (`pyproject.toml`, `src/hypermind/__init__.py`) —
+**Working version:** `2.3.0` (`pyproject.toml`, `src/hypermind/__init__.py`) —
 **engineering GA; SemVer now binding** (breaking changes only on major bumps, per
 [`CHANGELOG.md`](../../CHANGELOG.md)). Published on [PyPI](https://pypi.org/project/hypermind/).
 
@@ -295,6 +295,6 @@ trigger was evaluated and the project survived each gate:
 
 **Code lands fast; v1.0 GA is gated on the v1.0 §External & human deliverables list — none of which can be done by automation.**
 
-*Last updated: 2026-07-27. Working version: 2.1.5. Test suite: 4476 tests (`pytest --collect-only -q`).
-All engineering milestones shipped (v0.1 → v1.0 GA → v1.12 → v2.0 → v2.1.x).
+*Last updated: 2026-07-31. Working version: 2.3.0. Test suite: 5093 tests (`pytest --collect-only -q`).
+All engineering milestones shipped (v0.1 → v1.0 GA → v1.12 → v2.0 → v2.3.x).
 Remaining gates: §External & human deliverables only.*

{hypermind-2.2.1 → hypermind-2.4.0}/docs/project/v2.0-plan.md

@@ -8,7 +8,7 @@ This plan is preserved as a historical record of the v2.0 consolidation release.
 
 | v2.0 feature | Status | Where |
 |---|---|---|
-| `version = "2.0.0"` (now 2.1.5) | ✅ shipped | `pyproject.toml:7` |
+| `version = "2.0.0"` (now 2.3.0) | ✅ shipped | `pyproject.toml:7` |
 | `WIRE_VERSION_V3 = 3` added to `WIRE_VERSION_SUPPORTED` | ✅ shipped | `src/hypermind/wire.py:124-133, 188` |
 | `revocation_epoch` in CapToken canonical body (wire break — A-ALG-BOUND covers it) | ✅ shipped | `src/hypermind/capability.py:265-278, 505-523` |
 | `CapRevocationStore` auto-created on every `_NamespaceWorld` | ✅ shipped | `src/hypermind/agent.py:383-394, 419-426` |