mempalace-code 1.10.2__tar.gz → 1.10.4__tar.gz

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/settings.json

@@ -6,17 +6,17 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then echo '[pre-commit] Running verify gate...'; _s=$(mktemp); _u=$(mktemp); git diff --name-only --cached | sort >\"$_s\"; git diff --name-only | sort >\"$_u\"; MIXED=$(comm -12 \"$_s\" \"$_u\"); rm -f \"$_s\" \"$_u\"; if [ -n \"$MIXED\" ]; then echo '[warn] Staged files have unstaged changes (CI will not see them):'; echo \"$MIXED\" | sed 's/^/  /'; echo ''; fi; _tf=$(mktemp); if python -m pytest tests/ -x -q >\"$_tf\" 2>&1; then echo '[ok] pytest passed'; rm -f \"$_tf\"; else echo '[fail] pytest failed:'; tail -40 \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; _tf=$(mktemp); if ruff check mempalace/ tests/ >\"$_tf\" 2>&1; then echo '[ok] ruff check passed'; rm -f \"$_tf\"; else echo '[fail] ruff check failed:'; cat \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; _tf=$(mktemp); if ruff format --check mempalace/ tests/ >\"$_tf\" 2>&1; then echo '[ok] ruff format passed'; rm -f \"$_tf\"; else echo '[fail] ruff format failed:'; cat \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; if git diff --name-only --cached | grep -q 'BACKLOG.yaml'; then if ! backlog validate --file docs/BACKLOG.yaml >/dev/null 2>&1; then echo '[fail] backlog validate failed'; exit 1; else echo '[ok] backlog validate passed'; fi; fi; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then echo '[pre-commit] Running verify gate...'; _s=$(mktemp); _u=$(mktemp); git diff --name-only --cached | sort >\"$_s\"; git diff --name-only | sort >\"$_u\"; MIXED=$(comm -12 \"$_s\" \"$_u\"); rm -f \"$_s\" \"$_u\"; if [ -n \"$MIXED\" ]; then echo '[warn] Staged files have unstaged changes (CI will not see them):'; echo \"$MIXED\" | sed 's/^/  /'; echo ''; fi; _tf=$(mktemp); if python -m pytest tests/ -x -q >\"$_tf\" 2>&1; then echo '[ok] pytest passed'; rm -f \"$_tf\"; else echo '[fail] pytest failed:'; tail -40 \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; _tf=$(mktemp); if ruff check mempalace_code/ tests/ scripts/ >\"$_tf\" 2>&1; then echo '[ok] ruff check passed'; rm -f \"$_tf\"; else echo '[fail] ruff check failed:'; cat \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; _tf=$(mktemp); if ruff format --check mempalace_code/ tests/ scripts/ >\"$_tf\" 2>&1; then echo '[ok] ruff format passed'; rm -f \"$_tf\"; else echo '[fail] ruff format failed:'; cat \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; _tf=$(mktemp); if python -m pyright --pythonpath \"$(python -c 'import sys; print(sys.executable)')\" >\"$_tf\" 2>&1; then echo '[ok] pyright passed'; rm -f \"$_tf\"; else echo '[fail] pyright failed:'; cat \"$_tf\"; rm -f \"$_tf\"; exit 1; fi; if git diff --name-only --cached | grep -q 'BACKLOG.yaml'; then if ! backlog validate --file docs/BACKLOG.yaml >/dev/null 2>&1; then echo '[fail] backlog validate failed'; exit 1; else echo '[ok] backlog validate passed'; fi; fi; fi",
             "timeout": 300000
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then if git diff --name-only --cached | grep -qE '^mempalace/mcp_server\\.py$' && ! git diff --name-only --cached | grep -qE '^docs/AGENT_INSTALL\\.md$'; then echo '[warn] MCP server changed without AGENT_INSTALL.md update'; fi; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then if git diff --name-only --cached | grep -qE '^mempalace_code/mcp_server\\.py$' && ! git diff --name-only --cached | grep -qE '^docs/AGENT_INSTALL\\.md$'; then echo '[warn] MCP server changed without AGENT_INSTALL.md update'; fi; fi",
             "timeout": 5000
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then if git diff --name-only --cached | grep -qE '^mempalace/storage\\.py$' && ! git diff --name-only --cached | grep -qE '^docs/STORAGE\\.md$'; then echo '[warn] storage.py changed without STORAGE.md update'; fi; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'git commit'; then if git diff --name-only --cached | grep -qE '^mempalace_code/storage\\.py$' && ! git diff --name-only --cached | grep -qE '^docs/STORAGE\\.md$'; then echo '[warn] storage.py changed without STORAGE.md update'; fi; fi",
             "timeout": 5000
           }
         ]
@@ -38,22 +38,27 @@
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace/mcp_server\\.py'; then echo '[info] MCP server edited - update docs/AGENT_INSTALL.md if tool signatures changed'; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'pyproject\\.toml|uv\\.lock'; then echo '[info] Dependency metadata edited - run advisory checks, pip-audit, and clean resolver tests before release'; fi",
             "timeout": 5000
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace/storage\\.py'; then echo '[info] storage.py edited - run tests: python -m pytest tests/test_storage.py -v'; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace_code/mcp_server\\.py'; then echo '[info] MCP server edited - update docs/AGENT_INSTALL.md if tool signatures changed'; fi",
             "timeout": 5000
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace/miner\\.py'; then echo '[info] miner.py edited - run tests: python -m pytest tests/test_miner.py -v'; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace_code/storage\\.py'; then echo '[info] storage.py edited - run tests: python -m pytest tests/test_storage.py -v'; fi",
             "timeout": 5000
           },
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace/lang_detect\\.py|mempalace/chunker\\.py'; then echo '[info] Language support edited - run: python -m pytest tests/test_lang_detect.py tests/test_chunker.py -v'; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace_code/miner\\.py|mempalace_code/mining/'; then echo '[info] miner edited - run tests: python -m pytest tests/test_miner.py -v'; fi",
+            "timeout": 5000
+          },
+          {
+            "type": "command",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace_code/lang_detect\\.py|mempalace_code/chunker\\.py'; then echo '[info] Language support edited - run: python -m pytest tests/test_lang_detect.py tests/test_chunker.py -v'; fi",
             "timeout": 5000
           }
         ]
@@ -63,7 +68,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace (mine|health|repair|restore)'; then if echo \"$CLAUDE_TOOL_OUTPUT\" 2>/dev/null | grep -qiE 'error|fail|corrupt|missing'; then echo '[alert] Palace operation may have failed - consider running /palace-health'; fi; fi",
+            "command": "if echo \"$CLAUDE_TOOL_INPUT\" | grep -qE 'mempalace(-code)? (mine|health|repair|restore)'; then if echo \"$CLAUDE_TOOL_OUTPUT\" 2>/dev/null | grep -qiE 'error|fail|corrupt|missing'; then echo '[alert] Palace operation may have failed - consider running /palace-health'; fi; fi",
             "timeout": 5000
           }
         ]

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/_shared/commit-checkpoint.md

@@ -3,7 +3,7 @@
 Shared commit procedure for all skills that commit.
 Referenced by `/task-plan`, `/task-hardening`, `/ship`, and any future committing skill.
 
-**Purpose:** Prevent missed files, wrong staging, and lost work by cross-referencing the edit log against git state before every commit.
+**Purpose:** Prevent missed files, wrong staging, private artifact leaks, and lost work by cross-referencing the edit log against git state before every commit.
 
 ## Procedure
 
@@ -38,11 +38,22 @@ Compare the two lists. Flag discrepancies:
 
 - **Edited but unstaged** (`M` or `?? ` in git status, present in edit log): these MUST be staged or explicitly excluded with a reason.
 - **Staged but not in edit log** (in git status `M ` or `A ` index column, absent from edit log): warn — this may be another agent's work or a stale change. Verify before committing.
-- **Untracked task artifacts** (`?? .tasks/` or `?? .protocols/`): these MUST be staged if they belong to the current task.
+- **Local task artifacts** (`.tasks/`, `.protocols/`, `docs/audits/`): these MUST stay unstaged unless the user explicitly asks to publish a sanitized artifact. Treat them as local evidence by default.
 
 If any discrepancy is found, list it explicitly before proceeding. Do not silently skip mismatched files.
 
-### Step 3: Stage explicitly
+### Step 3: Run public-safety preflight
+
+Before staging, check whether the intended public diff contains secrets, private paths, local artifact directories, or private project names:
+
+```bash
+rg -n "(/Users/|/srv/[^[:space:]'\"`]+|[g]ithub_pat_|[g]hp_|[p]ypi-[A-Za-z0-9_-]{20,}|[s]k-[A-Za-z0-9])" -- $(git ls-files)
+git status --short | grep -E "^.. (\\.tasks/|\\.protocols/|docs/audits/)" && echo "ERROR: local artifacts must not be staged"
+```
+
+False positives such as placeholder tokens or policy text are allowed only after explicit review. Do not publish raw review logs, private benchmark results, local absolute paths, private remotes, or customer/project identifiers.
+
+### Step 4: Stage explicitly
 
 Stage ONLY the files that belong to this commit, by name:
 
@@ -52,15 +63,16 @@ git add <file1> <file2> ...
 
 **NEVER** use `git add .` or `git add -A`. If the edit log shows files you did not intend to modify, investigate before staging.
 
-### Step 4: Review staged diff
+### Step 5: Review staged diff
 
 ```bash
 git diff --cached --stat
+git diff --cached --name-only | grep -E "^(\\.tasks/|\\.protocols/|docs/audits/)" && echo "ERROR: local artifact staged"
 ```
 
 Verify the staged file count and names match expectations. If a file is unexpectedly large or unexpected, investigate.
 
-### Step 5: Commit
+### Step 6: Commit
 
 ```bash
 git commit -m "<message>"
@@ -78,18 +90,15 @@ Scope-risk: <boundary that future changes should be careful about>
 
 Queryable later via `git log --grep="Rejected:"` or `git log --grep="Constraint:"`.
 
-### Step 6: Post-commit verification
+### Step 7: Post-commit verification
 
 ```bash
-git status --short | grep -E "^\?\? \.(tasks|protocols)/TASK-" && echo "ERROR: task artifacts left unstaged — amend now" || echo "ok: no orphaned task artifacts"
+git show --name-only --pretty=format: HEAD | grep -E "^(\.tasks/|\.protocols/|docs/audits/)" && echo "ERROR: local artifact committed — revert/amend before pushing" || echo "ok: no local artifacts committed"
 ```
 
-If task artifacts remain unstaged:
-1. Stage them: `git add .tasks/TASK-<slug>/ .protocols/TASK-<slug>/`
-2. Amend: `git commit --amend --no-edit`
-3. Re-run the check.
+If local artifacts were committed, amend before pushing. Publish only sanitized summaries in tracked docs such as `docs/plans/`, `docs/refactoring/`, `docs/BACKLOG.yaml`, `CHANGELOG.md`, or release notes.
 
-### Step 7: Clear session state
+### Step 8: Clear session state
 
 ```bash
 : > /tmp/claude-edits.log

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/_shared/task-state.md

@@ -20,8 +20,8 @@ Structure:
   "phase": "triage",
   "started_at": "2026-04-17T14:30:00Z",
   "modified_files": [
-    "mempalace/miner.py",
-    "mempalace/lang_detect.py",
+    "mempalace_code/miner.py",
+    "mempalace_code/lang_detect.py",
     "docs/BACKLOG.yaml"
   ],
   "decisions": [
@@ -30,7 +30,7 @@ Structure:
     "F3: benchmark dataset — backlog only (score 1/3)"
   ],
   "pending_actions": [
-    "write round report to docs/audits/",
+    "write local-only round report to docs/audits/",
     "update BACKLOG.yaml",
     "commit via commit-checkpoint"
   ]

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/doc-refresh/INSTRUCTIONS.md

@@ -28,10 +28,10 @@ For each doc, diff changed source files since last doc commit:
 
 | Doc | Diff scope |
 |-----|-----------|
-| BACKUP_RESTORE.md | `mempalace/backup.py`, `mempalace/storage.py` |
-| AGENT_INSTALL.md | `mempalace/mcp_server.py`, MCP tools |
-| STORAGE.md | `mempalace/storage.py`, schema migrations |
-| CLAUDE.md | `.claude/skills/`, `mempalace/*.py` modules |
+| BACKUP_RESTORE.md | `mempalace_code/backup.py`, `mempalace_code/storage.py` |
+| AGENT_INSTALL.md | `mempalace_code/mcp_server.py`, MCP tools |
+| STORAGE.md | `mempalace_code/storage.py`, schema migrations |
+| CLAUDE.md | `.claude/skills/`, `mempalace_code/**/*.py` modules |
 | README.md | CLI commands, MCP tools, installation |
 
 Skip docs where diff is empty or test-only.

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/entropy-gc/INSTRUCTIONS.md

@@ -22,7 +22,7 @@ Scan for and fix entropy in the codebase: duplicated helpers, unvalidated bounda
 - **NEVER** delete code without verifying it's truly unused (check imports, tests)
 - **NEVER** use `git add .` or `git add -A` — explicit staging only
 - **ALWAYS** propose a "golden principle" for each recurring issue — prevent, don't just fix
-- **Scope argument**: accepts an optional directory argument (e.g., `/entropy-gc mempalace/`). If omitted, scans `mempalace/`, `tests/`
+- **Scope argument**: accepts an optional directory argument (e.g., `/entropy-gc mempalace_code/`). If omitted, scans `mempalace_code/`, `tests/`
 
 ## Workflow
 
@@ -52,7 +52,7 @@ Also check for:
 Data consumed without validation at system boundaries:
 
 ```
-Grep: pattern="json\.loads|yaml\.safe_load" glob="*.py" path="mempalace/"
+Grep: pattern="json\.loads|yaml\.safe_load" glob="*.py" path="mempalace_code/"
 ```
 
 **Ignore**: test files, internal module boundaries.
@@ -72,7 +72,7 @@ Cross-reference docs against code reality:
 Patterns that appear in recent files but violate project conventions:
 
 - **Bare except**: `Grep: pattern="except:" glob="*.py"` — should specify exception type
-- **Print statements**: `Grep: pattern="print\(" glob="*.py" path="mempalace/"` — should use logging
+- **Print statements**: `Grep: pattern="print\(" glob="*.py" path="mempalace_code/"` — should use logging
 - **Hardcoded paths**: `Grep: pattern="~/.mempalace|/Users/" glob="*.py"` — should use config
 - **Raw SQL**: `Grep: pattern="execute\(.*SELECT|INSERT|UPDATE" glob="*.py"` — check for injection risks
 
@@ -114,7 +114,7 @@ For each finding, classify the action:
 
 After user approves fixes:
 1. Apply changes in small, reviewable chunks
-2. Run verification: `python -m pytest tests/ -x -q && ruff check mempalace/`
+2. Run verification: `python -m pytest tests/ -x -q -m "not needs_network" && ruff check mempalace_code/ tests/ scripts/`
 3. Do NOT commit — leave for user to review and commit
 
 ### Golden Principles

mempalace_code-1.10.4/.claude/skills/release/SKILL.md

@@ -0,0 +1,161 @@
+---
+name: release
+description: Cut and verify a public release through publish remote, hosted CI, PyPI, and GitHub Release status
+disable-model-invocation: false
+---
+
+# Release Workflow
+
+Cut a public release. Use after `/release-prep` has synced docs, changelog, and
+version metadata.
+
+## When to Use
+
+- Ready to cut a new release
+- User says "release", "publish", "ship", or "bump version"
+
+## Steps
+
+### Step 1: Preflight
+
+Run `/verify`. If dependency bounds, lockfiles, workflows, storage, miner, or
+optional extras changed, also run the dependency gate:
+
+```bash
+python -m pytest tests/ -v -m "not needs_network"
+python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"
+ruff check mempalace_code/ tests/ scripts/
+ruff format --check mempalace_code/ tests/ scripts/
+```
+
+For dependency changes:
+
+```bash
+python -m pip install pip-audit
+pip-audit
+```
+
+Then reproduce the relevant hosted resolver surface in a clean temp venv. At
+minimum for package-bound or lockfile changes:
+
+```bash
+python3.13 -m venv /tmp/mempalace-ci-venv
+/tmp/mempalace-ci-venv/bin/python -m pip install -e ".[dev,treesitter]"
+/tmp/mempalace-ci-venv/bin/python -m pytest tests/ -v -m "not needs_network"
+```
+
+Check current public state:
+
+```bash
+grep -E "^version\s*=" pyproject.toml
+git ls-remote --tags publish 'refs/tags/v*' | tail -10
+python - <<'PY'
+import json, urllib.request
+data = json.load(urllib.request.urlopen("https://pypi.org/pypi/mempalace-code/json"))
+print(data["info"]["version"])
+PY
+```
+
+Do not rely on local tags or private remotes for public release truth.
+
+### Step 2: Confirm Version
+
+Use the version prepared by `/release-prep`. If the version is unclear, classify
+the bump:
+
+| Change Type | Version Bump |
+|-------------|--------------|
+| Breaking changes (API, CLI, storage format) | Major (X.0.0) |
+| New features (languages, MCP tools) | Minor (0.X.0) |
+| Bug fixes, docs, internal | Patch (0.0.X) |
+
+Ask user to confirm version if unclear.
+
+### Step 3: Commit
+
+```bash
+git status --short
+git add pyproject.toml CHANGELOG.md README.md docs/LLM_USAGE_RULES.md uv.lock
+git commit -m "chore: release vX.Y.Z"
+```
+
+Only add files that are part of the release. Never stage private local notes,
+tokens, temp files, or unrelated work.
+
+### Step 4: Tag
+
+```bash
+git tag -a vX.Y.Z -m "Release vX.Y.Z"
+```
+
+### Step 5: Push to Public Release Remote
+
+Ask user before pushing unless they already explicitly asked to publish:
+
+```
+Ready to push release vX.Y.Z to publish?
+- git push publish main
+- git push publish vX.Y.Z
+
+Proceed? [y/n]
+```
+
+```bash
+git push publish main
+git push publish vX.Y.Z
+```
+
+The tag triggers `.github/workflows/publish.yml` and publishes to PyPI through
+trusted publishing. Do not run manual `twine upload` unless the workflow is
+unavailable and the user explicitly approves the fallback.
+
+### Step 6: Verify Hosted Status
+
+Check all public surfaces separately:
+
+```bash
+gh run list --repo rergards/mempalace-code --branch main --workflow Tests --limit 5
+gh run list --repo rergards/mempalace-code --workflow "Publish to PyPI" --limit 5
+gh release view vX.Y.Z --repo rergards/mempalace-code
+python - <<'PY'
+import json, urllib.request
+version = "X.Y.Z"
+data = json.load(urllib.request.urlopen("https://pypi.org/pypi/mempalace-code/json"))
+print(data["info"]["version"])
+assert data["info"]["version"] == version
+PY
+```
+
+If the branch Tests run is red, the tag publish succeeded but the release is not
+clean. Fix and publish a follow-up patch before creating or advertising the
+GitHub Release as latest.
+
+If PyPI is visible but `gh release view` reports no release, create the GitHub
+Release only after hosted Tests are green:
+
+```bash
+gh release create vX.Y.Z --repo rergards/mempalace-code \
+  --title "vX.Y.Z" \
+  --notes-file /tmp/mempalace-release-notes.md
+```
+
+Release notes are public: include user-facing changes, package/version advisory
+IDs, and verification boundaries. Do not include private remotes, local paths,
+tokens, hostnames, or incident-only details.
+
+## Output
+
+```
+## Release vX.Y.Z
+
+Version: X.Y.Z
+Tag: vX.Y.Z
+Pushed to publish: [yes/no]
+Hosted Tests: [pass/fail/not-run]
+Publish to PyPI: [pass/fail/not-run]
+PyPI visible: [yes/no]
+GitHub Release: [created/existing/missing]
+
+Remaining blockers:
+- [none or exact blocker]
+```

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/release-prep/SKILL.md

@@ -49,10 +49,11 @@ Categorize user-facing changes:
 | Category | Signal |
 |----------|--------|
 | New feature | `feat(*)` with description (e.g. `feat(MINE-DART): Dart language support`) |
-| New MCP tool | `feat(MCP-*)` or diff touches `mempalace/mcp_server.py` tool registry |
+| New MCP tool | `feat(MCP-*)` or diff touches `mempalace_code/mcp_server.py` tool registry |
 | Bug fix | `fix(*)` not tagged `auto-fix verify` |
 | Docs | `docs(*)` |
 | Breaking | Any commit whose body says "BREAKING" or touches storage format / public API |
+| Dependency change | Diff touches `pyproject.toml` or `uv.lock` |
 
 ### Step 3: Detect feature surface changes
 
@@ -61,21 +62,38 @@ Cross-check the commit log against the code to catch anything the commit message
 **New languages in the miner** — diff language dispatch tables:
 
 ```bash
-git diff "$LAST_TAG..HEAD" -- mempalace/miner.py \
+git diff "$LAST_TAG..HEAD" -- mempalace_code/miner.py mempalace_code/mining/ \
   | grep -E '^\+.*(LANG_|_chunks|parse_|tool_|language.*=.*")'
 ```
 
 **New MCP tools** — compare tool registries:
 
 ```bash
-git show "$LAST_TAG:mempalace/mcp_server.py" 2>/dev/null \
+git show "$LAST_TAG:mempalace_code/mcp_server.py" 2>/dev/null \
   | grep -oE '"mempalace_[a-z_]+":' | sort -u > /tmp/mcp_before.txt
-grep -oE '"mempalace_[a-z_]+":' mempalace/mcp_server.py | sort -u > /tmp/mcp_after.txt
+grep -oE '"mempalace_[a-z_]+":' mempalace_code/mcp_server.py | sort -u > /tmp/mcp_after.txt
 diff /tmp/mcp_before.txt /tmp/mcp_after.txt
 ```
 
 **Python version bumps** — scan `pyproject.toml` history for `requires-python` changes.
 
+**Dependency bounds or lockfile changes** — list direct packages and run advisory
+checks before drafting public notes:
+
+```bash
+git diff "$LAST_TAG..HEAD" -- pyproject.toml uv.lock
+python - <<'PY'
+import tomllib
+data = tomllib.load(open("pyproject.toml", "rb"))
+print("runtime:", data["project"]["dependencies"])
+print("optional:", data["project"].get("optional-dependencies", {}))
+print("dev:", data.get("dependency-groups", {}).get("dev", []))
+PY
+```
+
+Do not raise an optional dependency ceiling into a known affected advisory
+range. Record held upgrades in `docs/BACKLOG.yaml` and `docs/plans/`.
+
 ### Step 4: Check docs for staleness
 
 For each item in Step 3, verify it appears in the right docs file.
@@ -86,6 +104,7 @@ For each item in Step 3, verify it appears in the right docs file.
 | New MCP tool | `README.md` — MCP tool inventory tables (Read / Write / Graph / Diary groups) |
 | New MCP tool | `docs/LLM_USAGE_RULES.md` — Routing table + any relevant rule section |
 | Python minimum bump | `README.md` Requirements section + `pyproject.toml` `requires-python` |
+| Dependency bound/security change | `CHANGELOG.md`, `CLAUDE.md`, and any relevant plan/backlog item |
 | Breaking change | `CHANGELOG.md` under `### Breaking` |
 | Any feature | `CHANGELOG.md` under the release header for this version |
 
@@ -179,6 +198,7 @@ Next: run /release to cut the tag and push to publish.
 - **`git describe --tags --abbrev=0` is wrong for this use case.** It returns the most recent local tag regardless of origin. Upstream tags pulled into the fork (e.g. v3.0.0 from an inherited upstream) will poison the result. Always use `git ls-remote --tags publish`.
 - **`pyproject.toml` version and the `publish`-remote latest tag should match** after the last release. If `pyproject.toml` is ahead, the previous release was cut but the tag never pushed — investigate before bumping again.
 - **Do not push to `origin` on release.** Per project feedback: releases go to `publish` only. `/release` handles this; this skill does not push.
+- **Dependency changes need an audit trail.** Before release notes claim a package upgrade is safe, verify current and target versions against OSV or an equivalent advisory source and test a clean hosted-CI-equivalent resolver. Public notes may include advisory IDs and version ranges; private resolver paths and local incident details stay out.
 - **Skip the per-task changelog headers.** Some autopilot flows write `## YYYY-MM-DD · TASK-SLUG` entries at the top of CHANGELOG as work lands. Before release, consolidate them into a single release header with grouped bullets. Do not leave both forms.
 
 ## Output

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/task-hardening/INSTRUCTIONS.md

@@ -70,7 +70,7 @@ If Codex should run for this round:
        - Score 0/3: dismiss with one-line justification in the round report. Do NOT backlog.
      - Record the triage decision for each finding in the round report. Format: `Finding | Score | Decision (fix/backlog/dismiss) | Reason`.
    - Implement only the triaged-in fixes (score >= 2/3). Add regression tests for each.
-   - Write the canonical round report to `docs/audits/<slug>-round-<n>.md`.
+   - Write the canonical local round report to `docs/audits/<slug>-round-<n>.md`.
 
 6. Backlog and resolve out-of-scope findings:
    - For every finding dismissed as pre-existing, out of scope, or deferred: either fix it on the spot if it is truly trivial, or add/update a backlog entry with origin context.
@@ -85,13 +85,15 @@ If Codex should run for this round:
     - Update `docs/BACKLOG.yaml` with hardening convergence status.
     - Follow the shared commit checkpoint procedure in `.claude/skills/_shared/commit-checkpoint.md`:
       - Read edit log, cross-reference git status, stage explicitly, review diff, commit, post-commit verify.
-    - Expected files to stage: `docs/audits/<slug>-round-<n>.md`, `docs/BACKLOG.yaml`, `.tasks/TASK-<slug>/`, `.protocols/TASK-<slug>/`, and any hardening fix files.
+    - Expected public files to stage: `docs/BACKLOG.yaml`, any hardening fix files, tests, changelog entries, and sanitized public plan/docs updates when needed.
+    - Expected local-only files to leave unstaged: `docs/audits/<slug>-round-<n>.md`, `.tasks/TASK-<slug>/`, `.protocols/TASK-<slug>/`, raw Codex output, local paths, and private benchmark data.
     - Commit message format: `chore(<slug>): hardening R<n> — <converged|findings backlogged>`
 
 ## Rules
 
-- Canonical round report remains in `docs/audits/`.
-- Codex output remains supporting evidence in `.tasks/TASK-<slug>/`.
+- Canonical round report remains local-only in ignored `docs/audits/`.
+- Codex output remains local-only supporting evidence in ignored `.tasks/TASK-<slug>/`.
+- Publish only sanitized summaries: backlog decisions, release notes, plan deltas, tests, and code changes with relative paths and no private context.
 - Prefer no finding over a weak finding.
 - If Codex cannot run because auth is missing, report that briefly and continue the hardening round.
 - Every dismissed or deferred material finding must be either fixed in-round or backlogged. Do not silently drop it.

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/task-plan/INSTRUCTIONS.md

@@ -41,7 +41,7 @@ If the user did not provide a slug, derive one from the task and state it explic
      - `Mode: lite; Codex: skipped`
    - stop
 
-4. For `standard` or `strict`, create task artifacts:
+4. For `standard` or `strict`, create local task artifacts:
 
 ```bash
 mkdir -p .tasks/TASK-<slug> .protocols/TASK-<slug>
@@ -81,7 +81,7 @@ If Codex review is required or justified, run:
 
 9. **Codex accessibility gate.** If Codex review is required but Codex is inaccessible (auth failure, 401, network error, CLI missing):
    - **Stop** — do not continue to the summary step or mark the plan as ready.
-   - **Save progress** — ensure `docs/plans/<slug>.md` and all `.tasks/TASK-<slug>/` artifacts are written to disk.
+   - **Save progress** — ensure `docs/plans/<slug>.md` and all local `.tasks/TASK-<slug>/` artifacts are written to disk.
    - **Update BACKLOG.yaml** — add note that task is blocked on Codex access.
    - **Commit immediately** — follow the shared commit checkpoint in `.claude/skills/_shared/commit-checkpoint.md`.
    - **Report** in chat: what was saved, why Codex failed, and that the task is parked.
@@ -93,7 +93,8 @@ If Codex review is required or justified, run:
 
     Follow the shared commit checkpoint procedure in `.claude/skills/_shared/commit-checkpoint.md`:
     - Read edit log, cross-reference git status, stage explicitly, review diff, commit, post-commit verify.
-    - Expected files to stage: `docs/plans/<slug>.md`, `docs/plans/<slug>-original.md`, `.protocols/TASK-<slug>/`, `.tasks/TASK-<slug>/`.
+    - Expected public files to stage: `docs/plans/<slug>.md`, `docs/plans/<slug>-original.md`, `docs/BACKLOG.yaml` if updated, and other sanitized public docs.
+    - Expected local-only files to leave unstaged: `.protocols/TASK-<slug>/`, `.tasks/TASK-<slug>/`, raw Codex output, local paths, and private benchmark data.
     - Commit message format: `docs(plan): <TASK-SLUG> — <mode> plan ready`
 
 12. End with a brief plan summary in the chat. Keep it short and execution-oriented. Include:
@@ -108,7 +109,7 @@ If Codex review is required or justified, run:
 - **Plan scope constraint**: Plans specify product-level acceptance criteria + high-level approach only. Do NOT include granular implementation steps (function names, variable names, line-by-line code changes). Over-specified plans cascade errors when implementation details are wrong — let the implementing agent determine its own path.
 - Keep `docs/plans/<slug>-original.md` untouched after first write.
 - Canonical final output remains `docs/plans/<slug>.md`.
-- Store supporting artifacts in `.tasks/TASK-<slug>/`.
+- Store supporting artifacts in ignored local `.tasks/TASK-<slug>/`; do not publish raw artifacts unless the user explicitly asks for a sanitized public artifact.
 - Do not treat Codex comments as truth; validate them against repository evidence.
 - Do not stop at writing the plan file; always give the user a brief summary of the final execution-ready plan.
 - If the task clearly qualifies for the fast path after the preflight scan, say so explicitly instead of manufacturing a durable plan just because `/task-plan` was invoked.

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.claude/skills/verify/INSTRUCTIONS.md

@@ -30,10 +30,10 @@ fi
 
 Classify the combined file list into these categories (a change can trigger multiple):
 
-- **core**: `mempalace/*.py` (storage, miner, searcher, mcp_server, etc.)
+- **core**: `mempalace_code/**/*.py`, `mempalace/*.py` (storage, miner, searcher, mcp_server, compatibility shims)
 - **tests**: `tests/*.py`
 - **docs**: `docs/*.md`, `README.md`, `CLAUDE.md`
-- **config**: `pyproject.toml`, `setup.py`, `.claude/`
+- **config**: `pyproject.toml`, `uv.lock`, `setup.py`, `.claude/`, `.github/workflows/`
 
 If no changes detected (clean tree, no baseline delta), run all checks — this is a health check invocation.
 
@@ -45,9 +45,20 @@ Run in parallel:
 
 | Check | Command | Timeout |
 |-------|---------|---------|
-| Lint | `ruff check mempalace/ tests/` | 30s |
-| Format | `ruff format --check mempalace/ tests/` | 30s |
-| Tests | `python -m pytest tests/ -x -q` | 120s |
+| Lint | `ruff check mempalace_code/ tests/ scripts/` | 30s |
+| Format | `ruff format --check mempalace_code/ tests/ scripts/` | 30s |
+| Tests | `python -m pytest tests/ -x -q -m "not needs_network"` | 120s |
+| Typecheck | `python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"` | 120s |
+| Strict slice typecheck | `python -m pyright -p pyrightconfig.strict.json` | 60s |
+| Public safety | `python scripts/public_safety_scan.py --tracked --staged` | 30s |
+| Scorecard | `python scripts/quality_scorecard.py --check` | 30s |
+
+The scorecard check is stdlib-only (no install, no network) and validates the
+quality scorecard's shape, determinism, public-safety, and committed artifact
+freshness. The public-safety scan checks tracked and staged repository files for
+private local paths, secret-like tokens, and local-only raw artifacts. After a
+quality change lands, regenerate the committed artifacts with
+`python scripts/quality_scorecard.py --write` (see `docs/quality/README.md`).
 
 ### If storage changed — add these
 
@@ -67,6 +78,25 @@ python -m pytest tests/test_miner.py tests/test_lang_detect.py -v
 python -m pytest tests/test_mcp_server.py -v
 ```
 
+### If dependencies changed — add these
+
+First check current and target versions against OSV or an equivalent advisory
+source. Do not accept a target version in an affected advisory range.
+
+Then audit a fresh resolver environment, not only the existing `.venv`:
+
+```bash
+python -m pip install pip-audit
+pip-audit
+python3.13 -m venv /tmp/mempalace-ci-venv
+/tmp/mempalace-ci-venv/bin/python -m pip install -e ".[dev,treesitter]"
+/tmp/mempalace-ci-venv/bin/python -m pytest tests/ -v -m "not needs_network"
+```
+
+If an optional extra changed, create a separate fresh environment for that
+extra and run its focused compatibility tests. For ChromaDB, do not install or
+raise into affected 1.x versions while GHSA-f4j7-r4q5-qw2c applies.
+
 ## Step 3: Report Results
 
 After all checks complete, output a verdict:
@@ -103,8 +133,8 @@ If a check fails, suggest the fix:
 
 | Error Pattern | Likely Fix |
 |---------------|-----------|
-| Ruff lint errors | `ruff check --fix mempalace/ tests/` |
-| Ruff format errors | `ruff format mempalace/ tests/` |
+| Ruff lint errors | `ruff check --fix mempalace_code/ tests/ scripts/` |
+| Ruff format errors | `ruff format mempalace_code/ tests/ scripts/` |
 | Import errors | Check venv: `pip install -e ".[dev]"` |
 | Test failures | Read the error, fix the code |
 | Missing fixture | Check conftest.py |

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.github/workflows/ci.yml

@@ -59,8 +59,12 @@ jobs:
             pyproject.toml
             uv.lock
       - run: pip install ruff
-      - run: ruff check mempalace_code/ tests/
-      - run: ruff format --check mempalace_code/ tests/
+      - run: ruff check mempalace_code/ tests/ scripts/
+      - run: ruff format --check mempalace_code/ tests/ scripts/
+      - name: Public-safety scan (tracked + staged)
+        run: python scripts/public_safety_scan.py --tracked --staged
+      - name: Quality scorecard (shape + determinism + public-safety)
+        run: python scripts/quality_scorecard.py --check
 
   typecheck:
     runs-on: ubuntu-latest
@@ -76,6 +80,8 @@ jobs:
       - run: pip install -e ".[dev,chroma,spellcheck,treesitter]"
       - name: Pyright typecheck
         run: python -m pyright --pythonpath "$(python -c 'import sys; print(sys.executable)')"
+      - name: Pyright strict slice
+        run: python -m pyright -p pyrightconfig.strict.json
 
   model-tests:
     runs-on: ubuntu-latest

{mempalace_code-1.10.2 → mempalace_code-1.10.4}/.gitignore

@@ -23,6 +23,7 @@ palace/
 .venv/
 venv/
 .env
+.verify-state
 
 # IDE
 .idea/
@@ -41,8 +42,13 @@ Thumbs.db
 docs/plans/
 docs/audits/
 .tasks/
+.protocols/
 autopilot.toml
 
+# Local benchmark outputs for external/private corpora
+benchmarks/results_token_delta_*.json
+!benchmarks/results_token_delta_mempalace.json
+
 # Claude Code session data (keep skills, prompts, settings.json tracked)
 .claude/*
 !.claude/skills/