pycontextdb 0.2.0__tar.gz → 0.3.0__tar.gz

pycontextdb-0.3.0/.github/CODEOWNERS

@@ -0,0 +1,14 @@
+# Maintainer review on the SDK and on anything that could ship a bad
+# PyPI artifact.
+# Username: https://github.com/gaufire
+
+* @gaufire
+
+/.github/ @gaufire
+/legal/ @gaufire
+/scripts/ @gaufire
+/NOTICE @gaufire
+/LICENSE @gaufire
+/CONTRIBUTING.md @gaufire
+/pyproject.toml @gaufire
+/contextdb/ @gaufire

pycontextdb-0.3.0/.github/pull_request_template.md

@@ -0,0 +1,10 @@
+## Summary
+
+<!-- What changed, and why. Evals win over prose. -->
+
+## Checklist
+
+- [ ] `pytest tests/evals/ -v` passes, or I explain why not.
+- [ ] `contextdb.init`, `factual.add`, `factual.recall`, and `search` keep working; new fields have backward-compatible defaults.
+- [ ] No new runtime dependency without a discussion first.
+- [ ] Substantial contribution: I agree to the CLA in CONTRIBUTING.md (legal name and email in this description). Trivial typo PRs may skip this.

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/.github/workflows/ci.yml

@@ -62,17 +62,3 @@ jobs:
 
       - name: Run tests
         run: pytest
-
-  open-core:
-    name: Open-core boundary
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
-      - name: Package-boundary and accidental-publication checks
-        run: python scripts/check_open_core.py

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/.github/workflows/publish.yml

@@ -25,9 +25,9 @@ jobs:
       - name: Build sdist and wheel
         run: python -m build
 
-      - name: Open-core and accidental-publication inspection
+      - name: Release-safety inspection
         run: |
-          python scripts/check_open_core.py --dist dist --release-tag "${{ github.event.release.tag_name }}"
+          python scripts/check_release.py --dist dist --release-tag "${{ github.event.release.tag_name }}"
 
       - name: Upload dist artifacts
         uses: actions/upload-artifact@v4
@@ -42,7 +42,7 @@ jobs:
 
     # Trusted-publisher flow: PyPI verifies this workflow via OIDC.
     # Require reviewers on this GitHub Environment so a published tag
-    # cannot reach PyPI without a human (OPEN_CORE.md).
+    # cannot reach PyPI without a human.
     environment:
       name: pypi
       url: https://pypi.org/project/pycontextdb/

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/.pre-commit-config.yaml

@@ -8,7 +8,7 @@
 
 repos:
   # Secret scanning — the reason this file exists. Gitleaks scans the
-  # staged diff for tokens (PyPI, GitHub, AWS, Stripe, Slack, generic
+  # staged diff for tokens (PyPI, GitHub, AWS, Slack, generic
   # entropy-high strings, ...). First run auto-downloads the binary.
   - repo: https://github.com/gitleaks/gitleaks
     rev: v8.30.0

pycontextdb-0.3.0/CHANGELOG.md

@@ -0,0 +1,107 @@
+# Changelog
+
+## Unreleased
+
+## 0.3.0 — 2026-08-18
+
+Host API scope hardening:
+
+- Every non-health HTTP route now runs the configured authentication,
+  including `/v1/trust_policy` and `/mcp`.
+- An authenticated `user_id` (from `auth_hook`) can no longer be
+  overridden by the JSON body, `X-ContextDB-User` header, query string,
+  or MCP tool arguments; a conflict is a clear 400 (`ScopeConflictError`)
+  instead of a silent pick.
+- `/mcp` propagates the authenticated scope into every tool call.
+- ID-based `confirm` / `forget` verify the target belongs to the resolved
+  user scope; a foreign `memory_id` raises `MemoryNotFoundError`,
+  indistinguishable from a missing one. Same guarantee on SQLite and
+  Postgres stores.
+- Anonymous loopback serving is unchanged and documented as *not* an
+  authorization boundary.
+
+Decision-layer and PII correctness:
+
+- `VerifyBeforeAct.decide()` / `confirm_pending()` accept an additive
+  per-call `user_id=` for shared clients; a scoped client still rejects a
+  foreign one.
+- SEARCH and DECIDE audit entries now persist only the PII-processed form
+  of the query — the append-only chain must never hold raw PII.
+- `pii_action="encrypt"` fails closed: without a key, `PIIDetector`
+  raises `ConfigError` instead of degrading to redact, and encryption
+  mode can never persist plaintext annotation originals.
+
+Postgres and audit concurrency:
+
+- Vector candidates are scoped by SQL *before* ranking — a large foreign
+  scope can no longer starve an in-scope hit out of the candidate budget.
+- The process-local vector index tracks a global store revision; a write
+  from another instance or process forces a rebuild before the next
+  search (stale reads are no longer served indefinitely).
+- Slot operations on Postgres serialize across processes via a
+  transaction-scoped advisory lock; audit-chain appends serialize
+  in-process (SQLite) and cross-process (Postgres), so the hash chain
+  cannot fork.
+- Real Postgres concurrent-worker tests cover corroboration, slot
+  supersede, audit-chain integrity, and cross-worker recall
+  (`CONTEXTDB_TEST_POSTGRES_URL`).
+
+Host-adoption work:
+
+- `contextdb serve --http` (`pycontextdb[serve]`) — JSON API + `/mcp`, Bearer token, `auth_hook`.
+- Per-call `user_id=` on add/recall/confirm/forget. Shared `init()` is the multi-tenant path; `ContextDBPool` is LRU if you still need one client per user.
+- OSS `PostgresStore` for `postgresql://` URLs (`pycontextdb[postgres]`).
+- `factual.pending_confirmations()`, `forget(memory_id=)` / `forget(entity=, attribute=)`, `add_many` / `add_fast_many`.
+- Recall filters: `entity`, `min_confidence`, `include_third_party`.
+- `db.on(event, hook)` for write/recall/confirm/forget/injection_suspect.
+- Query embedding LRU cache; lexical recall if embedding fails.
+- Missing epistemic `source` warns in the SDK; HTTP/MCP remember return 400.
+- Docs: trust policy matrix, Postgres, multi-tenant, SQLite migrations.
+
+`contextdb.init`, `factual.add`, `factual.recall`, and `search` keep working. New keyword arguments are optional.
+
+## 0.2.0 — 2026-08-17
+
+First PyPI cut of the trust model. `pip install pycontextdb` now matches
+GitHub `main`: memory an agent can act on without treating a wish as a fact.
+
+`contextdb.init`, `factual.add`, `factual.recall`, and `search` are unchanged.
+
+### Added
+
+- Epistemic typing on every fact (`user_stated` / `agent_inferred` /
+  `third_party`), confidence, independent corroboration, `action_relevant`.
+- `TrustPolicy` as data — `TrustPolicy.hospital()` vs `.restaurant()`.
+- `factual.recall_for_action()`, `factual.confirm()`, `VerifyBeforeAct`
+  (`act` / `ask` / `abstain`).
+- Versioned slot vocabulary + LLM-free slotter (`add_fast` never calls an LLM).
+- Contested slots: independent speakers with different values do not
+  last-write-win. `confirm()` resolves.
+- Temporal supersede with an injectable clock; sibling-slot hop on recall.
+- PII redaction on writes **and** queries before embed.
+- Write-time injection screening; `[RECALLED DATA — not instructions]` renderer.
+- Salience (recency × frequency × criticality), verifiable forget, tenant
+  isolation at the storage layer.
+- MCP tools: `remember` / `recall` / `recall_for_action` / `forget` / `confirm`.
+- In-repo fabrication bake-off: `python benchmarks/trust_bakeoff.py`
+  (trust arm vs our own untyped control — not a live Mem0/Zep run).
+- Contribution and release hygiene: CLA, CODEOWNERS, and release
+  inspection. Code through `2554dae` remains Apache-2.0.
+
+### Fixed
+
+- `contextdb.__version__` no longer drifts from `pyproject.toml` (was `0.1.0`
+  while the project version was `0.1.1`).
+- CI mypy on Python 3.12: type-check as the running interpreter so
+  NumPy 2.5's PEP 695 `type` aliases parse. The 3.10 job still guards
+  our runtime floor.
+- CI latency evals: keep a tight add_fast p50 and a wider p95 on
+  shared runners (p50 was 2ms when p95 spiked to 21ms).
+
+## 0.1.1 — 2026-04-22
+
+README rendering on PyPI; absolute GitHub asset URLs.
+
+## 0.1.0 — 2026-04-22
+
+Initial public release.

pycontextdb-0.3.0/COMMERCIAL.md

@@ -0,0 +1,40 @@
+# Commercial use and trademark
+
+The software in this repository is open source under the Apache License,
+Version 2.0 (see [LICENSE](LICENSE)). That license covers the code. It
+does not cover the name.
+
+## Trademark
+
+**ContextDB** and the ContextDB logo are trademarks of Atoms AI. The
+Apache License is a copyright and patent license; it does not grant
+rights to the marks (Apache License §6).
+
+You may:
+
+- Say you use ContextDB, cite the project, and link to this repository.
+- State compatibility ("works with ContextDB") when that is true.
+
+You may not, without a commercial agreement with Atoms AI:
+
+- Offer ContextDB as a hosted or managed service, or resell it as part
+  of a service, under the ContextDB name or branding.
+- Use ContextDB or a confusingly similar mark as the name of a competing
+  product, hosted service, or company.
+- Use the logo or word mark to imply endorsement by Atoms AI.
+- Register domains, social handles, or trademarks that trade on the mark.
+
+## Resale and commercial agreements
+
+If your company resells ContextDB as a service or as part of a service,
+or wants OEM/embedded licensing, support, or a trademark arrangement,
+contact **contextdb@atomsai.com** before you ship.
+
+## Attribution (optional)
+
+Apache-2.0 does not require a public credit line. If you ship a product
+that uses ContextDB and want to credit the project, the preferred form
+is a visible **Built with ContextDB** link to
+https://github.com/atomsai/contextdb — a courtesy, not a license
+condition. Redistributors must still keep `LICENSE` and `NOTICE` as
+Apache requires.

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/CONTRIBUTING.md

@@ -1,9 +1,8 @@
 # Contributing to ContextDB
 
 Thank you for wanting to improve ContextDB. This repository is the
-**open-core SDK**. Read [OPEN_CORE.md](OPEN_CORE.md) before you write
-code. If the change belongs in hosted multi-tenant operations, it does
-not belong here.
+Apache-2.0 ContextDB SDK: everything here works offline, with no feature
+gates.
 
 ## What we accept here
 
@@ -12,9 +11,9 @@ evals. Evals win over prose: `pytest tests/evals/ -v`.
 
 We do **not** accept:
 
-- Cloud control-plane, billing, SSO, or entitlement code
-- Local license keys or `if paid:` branches
-- Imports of `contextdb_cloud` or any private cloud package
+- Feature gates of any kind — no license keys, no `if paid:` branches,
+  no flags that only work against a hosted service
+- Imports of packages outside the declared dependencies
 - Changes that loosen PII-before-embed or the hash-chained audit log
 
 ## Contributor License Agreement
@@ -22,10 +21,10 @@ We do **not** accept:
 Trivial changes (typos, broken links, comment nits) do not need a CLA.
 
 **Substantial contributions** (new or material code, evals, or docs that
-are not typo-fixes) require a signed CLA **before** merge. The CLA lets
-Atoms AI relicense *future* contributions if dual-licensing ever
-matters. It does not change the Apache-2.0 grant on code already
-public through `2554dae`.
+are not typo-fixes) require a signed CLA **before** merge. The CLA grants
+the project broad rights to distribute your contribution, including under
+different license terms; code already released under Apache-2.0 stays
+Apache-2.0.
 
 1. Read [legal/CLA-individual.md](legal/CLA-individual.md) (or
    [legal/CLA-entity.md](legal/CLA-entity.md) if you contribute on
@@ -50,7 +49,6 @@ pre-commit install
 ruff check .
 mypy contextdb --strict
 pytest
-python scripts/check_open_core.py
 ```
 
 Do not break `contextdb.init`, `factual.add`, `factual.recall`, or
@@ -58,9 +56,8 @@ Do not break `contextdb.init`, `factual.add`, `factual.recall`, or
 
 ## Review
 
-[`.github/CODEOWNERS`](.github/CODEOWNERS) routes reviews. Governance
-files (`OPEN_CORE.md`, `COMMERCIAL.md`, `LICENSE`, `legal/`, workflows)
-need a maintainer.
+[`.github/CODEOWNERS`](.github/CODEOWNERS) routes reviews. `LICENSE`,
+`NOTICE`, `legal/`, and the workflows need a maintainer.
 
 ## License of your contribution
 

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/NOTICE

@@ -6,4 +6,5 @@ Licensed under the Apache License, Version 2.0. See LICENSE.
 
 ContextDB and the ContextDB logo are trademarks of Atoms AI.
 The Apache License does not grant permission to use the ContextDB
-trademarks. See COMMERCIAL.md.
+trademarks. For trademark and commercial licensing (including resale
+or hosted services), contact contextdb@atomsai.com. See COMMERCIAL.md.

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pycontextdb
-Version: 0.2.0
+Version: 0.3.0
 Summary: The unified context layer for AI agents — memory you can act on without treating wishes as facts
 Project-URL: Homepage, https://github.com/atomsai/contextdb
 Project-URL: Documentation, https://contextdb.dev
@@ -33,7 +33,10 @@ Requires-Dist: neo4j>=5.0; extra == 'all'
 Requires-Dist: pgvector>=0.2; extra == 'all'
 Requires-Dist: redis>=5.0; extra == 'all'
 Requires-Dist: sentence-transformers>=2.0; extra == 'all'
+Requires-Dist: starlette>=0.37; extra == 'all'
+Requires-Dist: uvicorn>=0.27; extra == 'all'
 Provides-Extra: dev
+Requires-Dist: httpx>=0.27; extra == 'dev'
 Requires-Dist: hypothesis>=6.0; extra == 'dev'
 Requires-Dist: mypy>=1.8; extra == 'dev'
 Requires-Dist: pre-commit>=3.0; extra == 'dev'
@@ -41,6 +44,7 @@ Requires-Dist: pytest-asyncio>=0.21; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0; extra == 'dev'
 Requires-Dist: pytest>=7.0; extra == 'dev'
 Requires-Dist: ruff>=0.4; extra == 'dev'
+Requires-Dist: starlette>=0.37; extra == 'dev'
 Provides-Extra: faiss
 Requires-Dist: faiss-cpu>=1.7; extra == 'faiss'
 Provides-Extra: local
@@ -55,6 +59,9 @@ Requires-Dist: redis>=5.0; extra == 'redis'
 Provides-Extra: rl
 Requires-Dist: torch>=2.0; extra == 'rl'
 Requires-Dist: trl>=0.7; extra == 'rl'
+Provides-Extra: serve
+Requires-Dist: starlette>=0.37; extra == 'serve'
+Requires-Dist: uvicorn>=0.27; extra == 'serve'
 Description-Content-Type: text/markdown
 
 <p align="center">
@@ -67,7 +74,7 @@ Description-Content-Type: text/markdown
 <p align="center">
   <a href="https://pypi.org/project/pycontextdb/"><img src="https://img.shields.io/pypi/v/pycontextdb.svg" alt="PyPI version"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License: Apache 2.0"></a>
-  <a href="https://github.com/atomsai/contextdb/blob/main/tests/"><img src="https://img.shields.io/badge/tests-122%20passing-brightgreen.svg" alt="Tests"></a>
+  <a href="https://github.com/atomsai/contextdb/blob/main/tests/"><img src="https://img.shields.io/badge/tests-139%20passing-brightgreen.svg" alt="Tests"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/pyproject.toml"><img src="https://img.shields.io/badge/mypy-strict-blue.svg" alt="Type Checked"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/benchmarks/run_benchmarks.py"><img src="https://img.shields.io/badge/search_p95-%3C5ms_%40_5K-brightgreen.svg" alt="Search p95"></a>
@@ -95,9 +102,14 @@ Description-Content-Type: text/markdown
 | **Search latency (5K memories)** | p50 **3.9ms** · p95 **5.0ms** |
 | **Vector search (10K × 1,536d)** | p50 **0.8ms** · p95 **1.0ms** |
 | **PII detection** | 100,000+ texts/sec |
-| **Tests** | 122 passing (incl. 34 trust-model acceptance evals) · ruff clean · mypy `--strict` clean |
+| **Tests** | 139 passing (incl. 34 trust-model acceptance evals) · ruff clean · mypy `--strict` clean |
 | **Dependencies** | SQLite + NumPy (FAISS / Postgres optional) |
 
+Those search numbers are **SQLite + the in-repo mock embedder**. A recall
+that embeds the query with OpenAI is typically **100–300ms** before the
+store is touched. Use `embedding_cache_size`, `pip install 'pycontextdb[local]'`,
+or `lexical_on_embed_failure` when the voice turn budget cannot wait.
+
 Hermetic, reproducible — run the suite yourself: `python benchmarks/run_benchmarks.py`.
 
 ---
@@ -549,7 +561,7 @@ Numbers above are from a MacBook-class laptop with no FAISS. Rerun `python bench
 
 ## Why not just use...
 
-**Mem0?** Their graph intelligence is a commercial add-on. ContextDB ships experiential memory, working-memory paging, and the trust bar in the Apache SDK — hosted multi-tenant operations are a separate Cloud product ([OPEN_CORE.md](OPEN_CORE.md)).
+**Mem0?** Their graph intelligence is a commercial add-on. ContextDB ships experiential memory, working-memory paging, and the trust bar in the Apache SDK.
 
 **Zep?** Strong bitemporal knowledge graphs. But no experiential memory, no working memory paging, no learned retrieval policies. Scope is narrower than a full memory OS.
 
@@ -588,14 +600,37 @@ Python 3.10+. No system dependencies for the default install — SQLite and NumP
 
 ---
 
-## Open core
+## HTTP and multi-tenant hosts
+
+```bash
+pip install 'pycontextdb[serve]'
+contextdb serve --http --port 8080 --token "$CONTEXTDB_SERVE_TOKEN"
+```
+
+One process, many users: `init()` without `user_id`, then pass `user_id=`
+on each call (or `X-ContextDB-User` on HTTP). Postgres:
+
+```bash
+pip install 'pycontextdb[postgres]'
+```
+
+```python
+db = contextdb.init(storage_url="postgresql://...")
+```
+
+See [docs/serve.md](docs/serve.md), [docs/multi_tenant.md](docs/multi_tenant.md),
+and [docs/trust_policy.md](docs/trust_policy.md).
+
+## License and attribution
 
-The SDK, trust model, and evals are Apache-2.0. Hosted multi-tenant
-operations live in a private `contextdb-cloud` repo that depends on this
-package — this package never depends on cloud. Entitlements are
-server-side. See [OPEN_CORE.md](OPEN_CORE.md) and
-[COMMERCIAL.md](COMMERCIAL.md). **ContextDB** is a trademark; the Apache
-license is not a trademark license.
+The SDK, trust model, and evals are Apache-2.0 — everything described in
+this README ships in this tree, with no feature gates. **ContextDB** is a
+trademark; the Apache license is not a trademark license. Reselling
+ContextDB as a service, or as part of one, under the ContextDB name or
+branding requires a commercial agreement with Atoms AI — contact
+contextdb@atomsai.com (see [COMMERCIAL.md](COMMERCIAL.md)). A public
+credit line is optional — if you want one, use **Built with ContextDB**
+linking to this repository.
 
 ## Contributing
 

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/README.md

@@ -8,7 +8,7 @@
 <p align="center">
   <a href="https://pypi.org/project/pycontextdb/"><img src="https://img.shields.io/pypi/v/pycontextdb.svg" alt="PyPI version"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/LICENSE"><img src="https://img.shields.io/badge/License-Apache%202.0-blue.svg" alt="License: Apache 2.0"></a>
-  <a href="https://github.com/atomsai/contextdb/blob/main/tests/"><img src="https://img.shields.io/badge/tests-122%20passing-brightgreen.svg" alt="Tests"></a>
+  <a href="https://github.com/atomsai/contextdb/blob/main/tests/"><img src="https://img.shields.io/badge/tests-139%20passing-brightgreen.svg" alt="Tests"></a>
   <a href="https://www.python.org/downloads/"><img src="https://img.shields.io/badge/python-3.10%2B-blue.svg" alt="Python 3.10+"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/pyproject.toml"><img src="https://img.shields.io/badge/mypy-strict-blue.svg" alt="Type Checked"></a>
   <a href="https://github.com/atomsai/contextdb/blob/main/benchmarks/run_benchmarks.py"><img src="https://img.shields.io/badge/search_p95-%3C5ms_%40_5K-brightgreen.svg" alt="Search p95"></a>
@@ -36,9 +36,14 @@
 | **Search latency (5K memories)** | p50 **3.9ms** · p95 **5.0ms** |
 | **Vector search (10K × 1,536d)** | p50 **0.8ms** · p95 **1.0ms** |
 | **PII detection** | 100,000+ texts/sec |
-| **Tests** | 122 passing (incl. 34 trust-model acceptance evals) · ruff clean · mypy `--strict` clean |
+| **Tests** | 139 passing (incl. 34 trust-model acceptance evals) · ruff clean · mypy `--strict` clean |
 | **Dependencies** | SQLite + NumPy (FAISS / Postgres optional) |
 
+Those search numbers are **SQLite + the in-repo mock embedder**. A recall
+that embeds the query with OpenAI is typically **100–300ms** before the
+store is touched. Use `embedding_cache_size`, `pip install 'pycontextdb[local]'`,
+or `lexical_on_embed_failure` when the voice turn budget cannot wait.
+
 Hermetic, reproducible — run the suite yourself: `python benchmarks/run_benchmarks.py`.
 
 ---
@@ -490,7 +495,7 @@ Numbers above are from a MacBook-class laptop with no FAISS. Rerun `python bench
 
 ## Why not just use...
 
-**Mem0?** Their graph intelligence is a commercial add-on. ContextDB ships experiential memory, working-memory paging, and the trust bar in the Apache SDK — hosted multi-tenant operations are a separate Cloud product ([OPEN_CORE.md](OPEN_CORE.md)).
+**Mem0?** Their graph intelligence is a commercial add-on. ContextDB ships experiential memory, working-memory paging, and the trust bar in the Apache SDK.
 
 **Zep?** Strong bitemporal knowledge graphs. But no experiential memory, no working memory paging, no learned retrieval policies. Scope is narrower than a full memory OS.
 
@@ -529,14 +534,37 @@ Python 3.10+. No system dependencies for the default install — SQLite and NumP
 
 ---
 
-## Open core
+## HTTP and multi-tenant hosts
+
+```bash
+pip install 'pycontextdb[serve]'
+contextdb serve --http --port 8080 --token "$CONTEXTDB_SERVE_TOKEN"
+```
+
+One process, many users: `init()` without `user_id`, then pass `user_id=`
+on each call (or `X-ContextDB-User` on HTTP). Postgres:
+
+```bash
+pip install 'pycontextdb[postgres]'
+```
+
+```python
+db = contextdb.init(storage_url="postgresql://...")
+```
+
+See [docs/serve.md](docs/serve.md), [docs/multi_tenant.md](docs/multi_tenant.md),
+and [docs/trust_policy.md](docs/trust_policy.md).
+
+## License and attribution
 
-The SDK, trust model, and evals are Apache-2.0. Hosted multi-tenant
-operations live in a private `contextdb-cloud` repo that depends on this
-package — this package never depends on cloud. Entitlements are
-server-side. See [OPEN_CORE.md](OPEN_CORE.md) and
-[COMMERCIAL.md](COMMERCIAL.md). **ContextDB** is a trademark; the Apache
-license is not a trademark license.
+The SDK, trust model, and evals are Apache-2.0 — everything described in
+this README ships in this tree, with no feature gates. **ContextDB** is a
+trademark; the Apache license is not a trademark license. Reselling
+ContextDB as a service, or as part of one, under the ContextDB name or
+branding requires a commercial agreement with Atoms AI — contact
+contextdb@atomsai.com (see [COMMERCIAL.md](COMMERCIAL.md)). A public
+credit line is optional — if you want one, use **Built with ContextDB**
+linking to this repository.
 
 ## Contributing
 

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/contextdb/__init__.py

@@ -12,7 +12,10 @@ from contextdb.core.exceptions import (
     ContextDBError,
     MemoryNotFoundError,
     PrivacyError,
+    ScopeConflictError,
+    SourceRequiredError,
     StorageError,
+    UnauthorizedError,
 )
 from contextdb.core.models import (
     Edge,
@@ -25,8 +28,9 @@ from contextdb.core.models import (
     RetentionPolicy,
 )
 from contextdb.core.policy import TrustPolicy
+from contextdb.pool import ContextDBPool
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 __all__ = [
     "Clock",
@@ -34,6 +38,7 @@ __all__ = [
     "ContextDB",
     "ContextDBConfig",
     "ContextDBError",
+    "ContextDBPool",
     "Edge",
     "Entity",
     "FrozenClock",
@@ -45,8 +50,11 @@ __all__ = [
     "PIIType",
     "PrivacyError",
     "RetentionPolicy",
+    "ScopeConflictError",
+    "SourceRequiredError",
     "StorageError",
     "TrustPolicy",
+    "UnauthorizedError",
     "__version__",
     "init",
     "utc_now",
@@ -70,7 +78,9 @@ def init(
     any I/O method, so ``init()`` itself does not touch the disk or network.
 
     Args:
-        user_id: Optional user scope. Every write carries this as a filter.
+        user_id: Default user scope. Omit this and pass ``user_id=`` on
+            each call for a shared multi-tenant client. A scoped client
+            cannot be widened to another user.
         config: Pre-built configuration. When ``None`` one is constructed
             from ``kwargs`` and environment variables prefixed with
             ``CONTEXTDB_``.

{pycontextdb-0.2.0 → pycontextdb-0.3.0}/contextdb/cli.py

@@ -52,6 +52,17 @@ def _build_parser() -> argparse.ArgumentParser:
     p_import = sub.add_parser("import", help="Import a ContextDB JSON dump.")
     p_import.add_argument("path")
 
+    p_serve = sub.add_parser("serve", help="Serve HTTP JSON (and /mcp) for non-Python hosts.")
+    p_serve.add_argument("--http", action="store_true", default=True, help="HTTP JSON API.")
+    p_serve.add_argument("--host", default="127.0.0.1")
+    p_serve.add_argument("--port", type=int, default=8080)
+    p_serve.add_argument("--token", default=None, help="Bearer token. Or CONTEXTDB_SERVE_TOKEN.")
+    p_serve.add_argument(
+        "--allow-anonymous",
+        action="store_true",
+        help="Allow unauthenticated requests (loopback only unless you pass this).",
+    )
+
     return parser
 
 
@@ -90,6 +101,17 @@ async def _run(args: argparse.Namespace) -> int:
             importer = JSONImporter(client)
             count = await importer.import_path(Path(args.path))
             print(f"Imported {count} memories from {args.path}")
+        elif args.command == "serve":
+            from contextdb.serve import serve_http
+
+            await serve_http(
+                client,
+                host=args.host,
+                port=args.port,
+                token=args.token,
+                allow_anonymous=args.allow_anonymous,
+            )
+            return 0
         else:
             return 1
         return 0