memcove 0.3.4__tar.gz

memcove-0.3.4/.dockerignore

@@ -0,0 +1,31 @@
+# Keep the build context small — only pyproject/lock, src, README, LICENSE are used.
+.git
+.github
+.venv
+.env
+.env.example
+.ruff_cache
+.pytest_cache
+__pycache__
+*.py[oc]
+build
+dist
+wheels
+*.egg-info
+
+# Not needed at runtime
+tests
+scripts
+docs
+site
+infra
+deploy
+internal
+*.md
+!README.md
+docker-compose.yml
+Dockerfile
+.dockerignore
+mkdocs.yml
+CHANGELOG.md
+ROADMAP.md

memcove-0.3.4/.env.example

@@ -0,0 +1,79 @@
+# --- Memcove configuration (copy to .env) ---
+
+# MCP server
+MEMCOVE_HOST=0.0.0.0
+MEMCOVE_PORT=8090
+
+# Iceberg REST catalog
+MEMCOVE_ICEBERG_REST_URI=http://localhost:8181
+MEMCOVE_ICEBERG_WAREHOUSE=s3://warehouse/
+MEMCOVE_ICEBERG_CATALOG_NAME=memcove
+
+# Object store (MinIO locally; real S3 in prod)
+MEMCOVE_S3_ENDPOINT=http://localhost:9000
+MEMCOVE_S3_REGION=us-east-1
+MEMCOVE_S3_ACCESS_KEY=minio
+MEMCOVE_S3_SECRET_KEY=minio12345
+MEMCOVE_S3_PATH_STYLE=true
+# Buckets / prefixes used by the data plane
+MEMCOVE_WAREHOUSE_BUCKET=warehouse
+MEMCOVE_STAGING_BUCKET=memcove-staging
+MEMCOVE_ARTIFACTS_BUCKET=memcove-artifacts
+
+# Trino (read / derive / export engine)
+MEMCOVE_TRINO_HOST=localhost
+MEMCOVE_TRINO_PORT=8080
+MEMCOVE_TRINO_USER=memcove                # service principal (connect identity when not impersonating)
+MEMCOVE_TRINO_CATALOG=iceberg
+MEMCOVE_TRINO_HTTP_SCHEME=http            # set https for a TLS-fronted Trino
+# Defense-in-depth: connect to Trino AS the caller's tenant so the operator's own
+# Trino access control applies per tenant. Requires impersonation rights on the
+# service principal + a configured grant backend. Off = single identity (dev).
+MEMCOVE_TRINO_IMPERSONATION=false
+# Session properties applied to every data connection (resource caps etc.) — generic
+# passthrough; set whatever your Trino version supports. JSON object.
+MEMCOVE_TRINO_SESSION_PROPERTIES={}
+# e.g. {"query_max_run_time":"60s","query_max_scan_physical_bytes":"10GB"}
+
+# Arrow Flight streaming data plane (M3)
+MEMCOVE_FLIGHT_HOST=0.0.0.0
+MEMCOVE_FLIGHT_PORT=8815
+MEMCOVE_FLIGHT_ADVERTISE_URI=grpc://localhost:8815
+# HMAC secret for signing Flight tickets/descriptors so a client cannot forge one for
+# another tenant. MUST be overridden in any real deployment (default is insecure).
+MEMCOVE_FLIGHT_TICKET_SECRET=dev-insecure-change-me
+MEMCOVE_FLIGHT_TICKET_TTL_SECONDS=300   # signed tickets expire after this many seconds
+
+# Postgres control-plane registry (host port 5433 avoids clashing with a local pg on 5432)
+MEMCOVE_PG_DSN=postgresql://memcove:memcove@localhost:5433/memcove
+# Connection pool sizing (min kept warm, grows to max under load; timeout in seconds
+# to wait for a free connection before erroring)
+MEMCOVE_PG_POOL_MIN_SIZE=1
+MEMCOVE_PG_POOL_MAX_SIZE=10
+MEMCOVE_PG_POOL_TIMEOUT=10.0
+
+# Guardrails
+MEMCOVE_PREVIEW_ROW_CAP=1000
+MEMCOVE_INLINE_BYTES_CAP=8388608        # 8 MiB max for inline ingest
+MEMCOVE_EXPORT_ROW_CAP=5000000          # safety cap for artifact export
+MEMCOVE_PRESIGN_TTL_SECONDS=3600
+
+# Tenancy. Default: trust a tenant header set by your auth proxy.
+MEMCOVE_TENANT_HEADER=x-memcove-tenant
+MEMCOVE_DEFAULT_TENANT=default
+# Provisioning map (optional). Set a subject/group header and Memcove maps the verified
+# identity -> internal tenant id, instead of trusting a raw tenant header. This is how
+# you avoid using a raw OIDC sub as a namespace. Leave subject header empty to disable.
+# Fail-closed: once the subject header is set, an unmapped identity is REJECTED (it never
+# falls back to the raw tenant header).
+MEMCOVE_TENANT_SUBJECT_HEADER=          # e.g. x-auth-subject
+MEMCOVE_TENANT_GROUP_HEADER=            # e.g. x-auth-groups (comma-separated)
+MEMCOVE_TENANT_MAP={}                   # JSON: {"oidc|abc":"acme","team-research":"research"}
+
+# Shared read-only reference plane (the gateway). Schemas every tenant may SELECT
+# from but none may write; not rewritten to the caller's namespace. JSON list.
+MEMCOVE_SHARED_SCHEMAS=["ref_market"]
+
+# Ingest allowlist for agent-supplied s3_parquet URIs. Empty = feature DISABLED
+# (fail closed). JSON list of permitted s3:// prefixes.
+MEMCOVE_ALLOWED_S3_INGEST_PREFIXES=[]

memcove-0.3.4/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,40 @@
+name: Bug report
+description: Report a problem with Memcove
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file a bug! For **security vulnerabilities**,
+        do not use this form — see [SECURITY.md](../blob/main/SECURITY.md).
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug, including what you expected instead.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: Minimal steps, the MCP tool / SQL / config involved, and any error output.
+      placeholder: |
+        1. …
+        2. …
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Memcove version / commit
+      placeholder: "0.3.2 or a commit SHA"
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: How you're running it (local compose, Kubernetes, …), Python version, and which registry DB / Trino setup.
+    validations:
+      required: false

memcove-0.3.4/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/memcove/memcove/security/advisories/new
+    about: Please report security issues privately, not as public issues.
+  - name: Documentation
+    url: https://memcove.github.io/memcove/
+    about: Check the docs before filing — your question may be answered there.

memcove-0.3.4/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,24 @@
+name: Feature request
+description: Suggest an idea or enhancement for Memcove
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What are you trying to do, and what's getting in the way?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like to see? Sketch the tool, config, or behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

memcove-0.3.4/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What does this change and why? -->
+
+## Changes
+
+<!-- Bullet the notable changes. -->
+
+-
+
+## Testing
+
+<!-- How did you verify this? -->
+
+- [ ] `uv run ruff check .` passes
+- [ ] `uv run pytest -m "not integration"` passes
+- [ ] `uv run pytest -m integration` passes (if the change touches the data/registry path)
+
+## Checklist
+
+- [ ] Conventional Commit title (`feat:` / `fix:` / `chore:` / `docs:` …)
+- [ ] `CHANGELOG.md` updated (and `pyproject.toml` version bumped) if user-facing
+- [ ] Docs updated if behavior or configuration changed

memcove-0.3.4/.github/workflows/ci.yml

@@ -0,0 +1,91 @@
+name: CI
+
+# Lint + tests on every PR and on pushes to main. The docs site has its own
+# workflow (docs.yml); this one gates code quality.
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to the same ref supersedes an in-flight run.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Install (frozen — uses the committed uv.lock)
+        run: uv sync --extra dev --frozen
+      - name: Ruff lint
+        run: uv run ruff check .
+      # NOTE: `ruff format --check` is intentionally not gated yet — the codebase
+      # uses a compact hand-formatting style that predates ruff-format adoption.
+      # Add it here after a dedicated one-shot `ruff format` normalization commit.
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Install (frozen)
+        run: uv sync --extra dev --frozen
+      - name: Unit tests
+        run: uv run pytest -m "not integration" -q
+
+  integration:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+          enable-cache: true
+      - name: Install (frozen)
+        run: uv sync --extra dev --frozen
+      - name: Bring up the local lakehouse
+        run: docker compose up -d --wait
+      - name: Integration tests
+        run: uv run pytest -m integration -q
+      - name: Tear down
+        if: always()
+        run: docker compose down -v
+
+  docker-build:
+    # Exercise the Dockerfile on every PR (build only, no push) so image breakage
+    # is caught here rather than at release time.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - name: Build image (amd64, no push)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          load: true
+          tags: memcove:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+      - name: Smoke-test /health
+        run: |
+          docker run -d --name memcove-ci -p 8090:8090 memcove:ci
+          for i in $(seq 1 20); do
+            if curl -sf http://localhost:8090/health >/dev/null; then echo "healthy"; break; fi
+            sleep 1
+          done
+          curl -sf http://localhost:8090/health | grep -q ok
+          docker rm -f memcove-ci

memcove-0.3.4/.github/workflows/docs.yml

@@ -0,0 +1,56 @@
+name: Deploy docs
+
+# Build the mkdocs-material site and publish it to GitHub Pages on every push to
+# main that touches the docs. Requires the repo's Pages source to be set to
+# "GitHub Actions" (Settings -> Pages -> Build and deployment -> Source).
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
+
+# Least-privilege token: read the repo, publish to Pages via OIDC.
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Never let two Pages deploys race; the newest push wins.
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      - name: Install docs toolchain
+        run: pip install -r docs/requirements.txt
+      - name: Build site (strict — fails on broken links or missing nav)
+        run: mkdocs build --strict
+      - uses: actions/configure-pages@v5
+        with:
+          # Create/enable the Pages site (build type = GitHub Actions) if it isn't
+          # already, so the first deploy doesn't fail with "Get Pages site failed".
+          enablement: true
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: ./site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

memcove-0.3.4/.github/workflows/release.yml

@@ -0,0 +1,128 @@
+name: Release
+
+# Cut a release on a semver tag (e.g. `git tag v0.3.4 && git push --tags`):
+#   - build a multi-arch image and push to Docker Hub + GHCR
+#   - publish the wheel to PyPI (trusted publishing / OIDC)
+#   - create a GitHub Release from the matching CHANGELOG section
+#
+# Required repo config:
+#   - secrets DOCKERHUB_USERNAME + DOCKERHUB_TOKEN (Docker Hub push)
+#   - a PyPI "trusted publisher" for this repo/workflow (no token needed)
+#   GHCR uses the built-in GITHUB_TOKEN.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to (re)release, e.g. v0.3.4"
+        required: true
+
+permissions:
+  contents: write # create the GitHub Release
+  packages: write # push to GHCR
+  id-token: write # PyPI trusted publishing
+
+env:
+  # Docker Hub repo lives under the maintainer's personal namespace.
+  DOCKERHUB_IMAGE: andrzejgluszynski/memcove
+  GHCR_IMAGE: ghcr.io/memcove/memcove
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive version from tag
+        id: version
+        run: |
+          REF="${{ github.event.inputs.tag || github.ref_name }}"
+          V="${REF#v}"
+          echo "value=$V" >> "$GITHUB_OUTPUT"
+          echo "minor=${V%.*}" >> "$GITHUB_OUTPUT"  # 0.3.4 -> 0.3
+
+      - name: Image metadata (tags + labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ env.DOCKERHUB_IMAGE }}
+            ${{ env.GHCR_IMAGE }}
+          # Derive tags from the explicit version (not the git ref) so this works
+          # on both a tag push and a manual workflow_dispatch re-run.
+          tags: |
+            type=raw,value=${{ steps.version.outputs.value }}
+            type=raw,value=${{ steps.version.outputs.minor }}
+            type=raw,value=latest
+
+      - name: Build and push (amd64 + arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: MEMCOVE_VERSION=${{ steps.version.outputs.value }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  github-release:
+    runs-on: ubuntu-latest
+    needs: [image, pypi]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+      - name: Extract this version's changelog section
+        id: notes
+        run: |
+          VERSION="${{ github.event.inputs.tag || github.ref_name }}"
+          VERSION="${VERSION#v}"
+          # Print lines from "## [VERSION]" up to (not including) the next "## [".
+          awk -v v="$VERSION" '
+            $0 ~ "^## \\[" v "\\]" {p=1; next}
+            p && /^## \[/ {exit}
+            p {print}
+          ' CHANGELOG.md > release_notes.md
+          if [ ! -s release_notes.md ]; then echo "See CHANGELOG.md" > release_notes.md; fi
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
+          name: ${{ github.event.inputs.tag || github.ref_name }}
+          body_path: release_notes.md

memcove-0.3.4/.gitignore

@@ -0,0 +1,29 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
+
+# Local config
+.env
+
+# Test / pytest caches
+.pytest_cache/
+
+# Claude setup
+.claude/
+
+# Internal docs
+internal/
+
+# macOS
+.DS_Store
+ROADMAP.md
+
+# mkdocs build output
+site/

memcove-0.3.4/CHANGELOG.md

@@ -0,0 +1,125 @@
+# Changelog
+
+All notable changes to Memcove are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/), and the project aims to follow
+semantic versioning once it reaches 1.0.
+
+## [0.3.4] - 2026-07-07
+
+### Added
+- **Container image** — a multi-stage `Dockerfile` (non-root, `python:3.12-slim`,
+  deps installed frozen from `uv.lock`) shipping all three entrypoints
+  (`memcove-server` default, `memcove-flight`, `memcove-reconcile`). Plus a
+  `.dockerignore`.
+- **`/health` and `/ready` HTTP endpoints** on the MCP server — liveness always
+  returns 200; readiness checks the metadata registry (`SELECT 1`) and Trino
+  reachability and returns 503 with per-check detail when a dependency is down.
+  Wire these to Kubernetes probes. Adds `registry.ping()`.
+- **Release automation** — `.github/workflows/release.yml`: on a `v*` tag, builds a
+  multi-arch (amd64+arm64) image and pushes to Docker Hub + GHCR, publishes the wheel
+  to PyPI (trusted publishing), and creates a GitHub Release from the CHANGELOG. CI now
+  also builds the image and smoke-tests `/health` on every PR.
+
+## [0.3.3] - 2026-07-07
+
+### Added
+- **Open-source foundations** — `LICENSE` (Apache-2.0), `CONTRIBUTING.md`,
+  `CODE_OF_CONDUCT.md`, `SECURITY.md`, and GitHub issue/PR templates. `pyproject.toml`
+  now declares the license, classifiers, and project URLs.
+- **CI test/lint gate** — `.github/workflows/ci.yml` runs `ruff check` and the unit
+  suite on every PR, plus an integration job against the docker-compose stack. (The
+  existing `docs.yml` still handles the docs site.)
+
+### Changed
+- **Reproducible installs** — `uv.lock` is now committed (was gitignored).
+- **Local-stack reliability** — `docker-compose.yml` gives Trino a real healthcheck so
+  `docker compose up -d --wait` blocks until it's ready, replacing the "sleep ~20s"
+  guidance in the README and quickstart.
+
+## [0.3.2] - 2026-07-06
+
+### Changed
+- **orjson for JSON serialization** — the Flight ticket codec (`data_plane/tickets.py`),
+  the structured audit log (`core/audit.py`), and the JSON artifact export
+  (`tools/artifacts.py`) now serialize/parse with `orjson` instead of the stdlib `json`
+  module. orjson was already installed transitively (via `trino`) and is now a declared
+  dependency. Signing is unaffected — HMAC canonicalization uses `orjson.OPT_SORT_KEYS`
+  on both the sign and verify paths. One behavior change: JSON exports now render
+  `datetime`/`UUID` values as native ISO 8601 (e.g. `2024-01-01T00:00:00`) rather than
+  Python `str()`; `Decimal`/`bytes` still fall through to `default=str` unchanged.
+
+## [0.3.1] - 2026-07-05
+
+### Changed
+- **Pooled Postgres connections** — the registry now backs its connection helpers with
+  a lazily-opened `psycopg_pool` pool instead of opening a fresh connection per op
+  (the reconciler and read-repair had raised per-op churn). Connections are health-
+  checked on borrow, so a Postgres restart or idle drop no longer hands a dead
+  connection to the next caller. Sizing/timeout via `MEMCOVE_PG_POOL_{MIN_SIZE,MAX_SIZE,TIMEOUT}`.
+  Write-atomicity is unaffected: pool timeouts subclass `OperationalError`, so a
+  saturated/unreachable registry is still swallowed as `metadata_pending`.
+
+## [0.3.0] - 2026-07-05
+
+Write atomicity (M5). A crash or concurrent reader can no longer see a half-written
+object, and the registry now self-heals when it drifts from the Iceberg catalog.
+
+### Added
+- **Atomic full-table replace** — `mode=replace` uses each engine's native atomic
+  swap (PyIceberg `overwrite()` for ingest/Flight, Trino `CREATE OR REPLACE TABLE`
+  for derive) instead of drop-then-create. A concurrent reader sees the old rows or
+  the new rows, never a missing table, and a mid-write crash no longer loses data.
+- **Schema-compatibility guard** — replace and append reject a changed shape
+  (added/removed/retyped column) with `SchemaMismatchError` rather than silently
+  evolving it, so downstream SQL never breaks. `forget()` then `create()` to reshape.
+- **Guarded registry write** — the object row and its lineage commit in one
+  transaction; if the registry write fails after the data is committed, the tool
+  returns a `metadata_pending` object and logs the drift instead of failing the write.
+- **Synchronous read-repair** — `describe_object` on a registry miss backfills a
+  `reconciled` row inline when the table exists, so an orphaned object becomes
+  visible on the next read (the guarantee holds before the M7 reconcile cron).
+- **Reconciler** (`memcove-reconcile`) — sweeps registry vs catalog and repairs both
+  directions. Deletion is deliberately timid: fail-safe on an empty listing (never
+  wipes a tenant on a transient catalog hiccup), a deletion cap with an absolute
+  floor, a two-sweep grace period, and a live re-check just before deleting.
+
+### Changed
+- Dev/CI Trino pinned to `431` (the minimum for `CREATE OR REPLACE TABLE` on the
+  Iceberg connector); operators bringing their own Trino need `>= 431`.
+
+## [0.2.0] - 2026-07-04
+
+The agent SQL gateway security core and its configuration seams. Every tenant
+gets a private namespace plus a shared read-only reference plane, enforced by the
+SQL guard and (optionally) the operator's own Trino access control.
+
+### Added
+- **Shared reference plane** — `MEMCOVE_SHARED_SCHEMAS` lets every tenant read
+  configured read-only schemas (e.g. `ref_market`) while writing only their own.
+  The SQL guard resolves shared schemas to themselves and rejects everything else.
+- **Configurable Trino principal** — `MEMCOVE_TRINO_IMPERSONATION` connects to
+  Trino as the calling tenant so the operator's grant backend applies per tenant
+  (defense-in-depth beneath the guard). Off by default (single service identity).
+- **Provisioning-map tenant resolution** — map a verified identity (subject/group)
+  to an internal tenant id via `MEMCOVE_TENANT_SUBJECT_HEADER` + `MEMCOVE_TENANT_MAP`
+  instead of trusting a raw OIDC `sub`. Fail-closed: unmapped identities are rejected.
+- **Signed Arrow Flight tickets** — HMAC-signed, expiring tickets/descriptors so a
+  gRPC client cannot forge one for another tenant (`MEMCOVE_FLIGHT_TICKET_SECRET`).
+- **`discover_reference_data` tool** — a curated view of the shared schemas, since
+  agents are denied `information_schema`.
+- **Audit log** — structured JSON on the `memcove.audit` logger for every accepted
+  read/derive/export, plus configurable Trino resource caps
+  (`MEMCOVE_TRINO_SESSION_PROPERTIES`).
+- **S3 ingest allowlist** — agent-supplied `s3_parquet` URIs must match
+  `MEMCOVE_ALLOWED_S3_INGEST_PREFIXES` (disabled/fail-closed by default).
+- **Configuration guide + example deploy manifests** — `docs/CONFIGURATION.md`,
+  `deploy/networkpolicy.example.yaml`, `deploy/values.example.yaml`.
+
+### Security
+- SQL guard now denies metadata/enumeration schemas (`information_schema`,
+  `system`, `SHOW`/`DESCRIBE`/`EXPLAIN`), case-folds identifiers so a quoted
+  mixed-case name can't smuggle a foreign schema, and fails closed on any
+  FROM-item it can't classify (e.g. polymorphic `TABLE(...)` functions).
+- `upload_handle` ingest is bound to the calling tenant's `uploads/{tenant}/` prefix.
+- S3 allowlist matches on a path boundary (`s3://bucket` no longer permits
+  `s3://bucket-evil`).