pycontextdb 0.4.3__tar.gz → 0.4.5__tar.gz

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 ## Unreleased
 
+## 0.4.5 — 2026-10-05
+
+- `forget_user` no longer deletes other users' memories. It added every graph
+  neighbor of the erased memories to the deletion set, and entity edges join
+  any memories that mention the same name, so on a shared client with the
+  entity graph and an extraction model, erasing one user could hard-delete
+  another user's memories. It now deletes only the user's memories and the
+  summaries derived from them, and severs their graph edges.
+- Consolidated summaries keep the weakest corroboration count of their inputs
+  instead of the sum. Repeated copies of one third-party claim could
+  consolidate into a summary that passed the default trust bar and was
+  returned by `recall_for_action`. The summary now stays pending confirmation.
+- Unchanged limitation: entity rows are shared across users, and attributes
+  merged into an entity from a user's text are not removed by `forget_user`.
+
+## 0.4.4 — 2026-09-20
+
+- PostgreSQL sibling composition now uses an ordered user-plus-entity cache
+  index, so a scoped recall does not scan other users that share the same
+  entity key.
+
 ## 0.4.3 — 2026-09-20
 
 - High-cardinality Postgres recall now indexes cached IDs by user and entity,

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pycontextdb
-Version: 0.4.3
+Version: 0.4.5
 Summary: The unified context layer for AI agents — memory you can act on without treating wishes as facts
 Project-URL: Homepage, https://github.com/atomsai/contextdb
 Project-URL: Documentation, https://contextdb.dev
@@ -120,7 +120,7 @@ Speed is table stakes. The production failure that gets agents fired is **acting
 
 Every memory carries **epistemic provenance** (`user_stated` / `agent_inferred` / `third_party`), **confidence**, **independent corroboration** (same-speaker repeats do not count), and an **action-relevant** flag. The action bar is data — `TrustPolicy.hospital()` vs `TrustPolicy.restaurant()` — not a hardcoded `if`. Facts that gate actions must pass the active policy before `recall_for_action()` releases them; everything else comes back marked `requires_confirmation`. `factual.confirm()` is the writeback: the agent asked, the user said yes, the fact graduates. Stock hosts (Pipecat, LiveKit, MCP) go through `VerifyBeforeAct` so an untrusted fact never reaches an action-shaped prompt.
 
-On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that walks graph edges, and **tenant/agent isolation enforced at the storage layer**.
+On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that severs graph edges without touching other users' memories, and **tenant/agent isolation enforced at the storage layer**.
 
 Don't take our word for it — the fabrication benchmark ships in-repo and runs on every PR. Same store, same embedder, same utterance policy; the only difference is the trust model:
 

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/README.md

@@ -54,7 +54,7 @@ Speed is table stakes. The production failure that gets agents fired is **acting
 
 Every memory carries **epistemic provenance** (`user_stated` / `agent_inferred` / `third_party`), **confidence**, **independent corroboration** (same-speaker repeats do not count), and an **action-relevant** flag. The action bar is data — `TrustPolicy.hospital()` vs `TrustPolicy.restaurant()` — not a hardcoded `if`. Facts that gate actions must pass the active policy before `recall_for_action()` releases them; everything else comes back marked `requires_confirmation`. `factual.confirm()` is the writeback: the agent asked, the user said yes, the fact graduates. Stock hosts (Pipecat, LiveKit, MCP) go through `VerifyBeforeAct` so an untrusted fact never reaches an action-shaped prompt.
 
-On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that walks graph edges, and **tenant/agent isolation enforced at the storage layer**.
+On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that severs graph edges without touching other users' memories, and **tenant/agent isolation enforced at the storage layer**.
 
 Don't take our word for it — the fabrication benchmark ships in-repo and runs on every PR. Same store, same embedder, same utterance policy; the only difference is the trust model:
 

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/contextdb/__init__.py

@@ -41,7 +41,7 @@ from contextdb.core.policy import TrustPolicy
 from contextdb.pool import ContextDBPool
 from contextdb.utils.embeddings import EmbeddingProvider
 
-__version__ = "0.4.3"
+__version__ = "0.4.5"
 
 __all__ = [
     "Clock",

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/contextdb/client.py

@@ -1685,21 +1685,13 @@ class ContextDB:
             if added == 0:
                 break
 
-        # Walk graph edges: a forgotten fact that still has neighbors is
-        # how "forgotten" memories regenerate — not from the row, from
-        # the graph.
+        # Sever graph edges so a forgotten memory cannot be reached or
+        # rebuilt through the graph. Neighbors are never added to the
+        # deletion set: entity edges join every memory that mentions the
+        # same name, including other users' memories, and this user's own
+        # and derived memories are already in ``targets``.
         for graph in self._graphs.values():
             for memory_id in list(targets):
-                try:
-                    neighbors = await graph.get_neighbors(memory_id, max_results=50)
-                except Exception:  # noqa: BLE001
-                    continue
-                for nid, _weight in neighbors:
-                    if nid in targets:
-                        continue
-                    neighbor = await store.get_raw(nid)
-                    if neighbor is not None:
-                        targets[nid] = neighbor
                 try:
                     await graph.remove_node(memory_id)
                 except Exception:  # noqa: BLE001

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/contextdb/dynamics/evolution.py

@@ -98,7 +98,8 @@ class Consolidator:
             # Trust-conservative merge: a summary must never be MORE trusted
             # than its least trusted input. Otherwise consolidation launders
             # epistemic status — five third-party hearsay fragments would
-            # emerge as a confident first-party fact.
+            # emerge as a confident first-party fact. Corroboration is not
+            # summed: copies of one claim are not independent support.
             new_item = MemoryItem(
                 content=summary,
                 embedding=cluster_items[0].embedding,
@@ -110,7 +111,7 @@ class Consolidator:
                     key=lambda s: _SOURCE_RANK[s],
                 ),
                 confidence=min(m.confidence for m in cluster_items),
-                corroboration_count=sum(m.corroboration_count for m in cluster_items),
+                corroboration_count=min(m.independent_corroboration for m in cluster_items),
                 action_relevant=any(m.action_relevant for m in cluster_items),
                 injection_suspect=any(m.injection_suspect for m in cluster_items),
             )

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/contextdb/store/postgres_store.py

@@ -282,6 +282,10 @@ class PostgresStore(BaseStore):
         self._index_items: dict[str, MemoryItem] = {}
         self._index_ids_by_user: dict[str | None, set[str]] = {}
         self._index_ids_by_entity: dict[str, dict[str, None]] = {}
+        self._index_ids_by_user_entity: dict[
+            tuple[str | None, str],
+            dict[str, None],
+        ] = {}
         self._embedding_dim = embedding_dim
         self._embedding_model_id = embedding_model_id
         self._index_loaded = False
@@ -389,6 +393,10 @@ class PostgresStore(BaseStore):
         self._index_ids_by_user.setdefault(item.user_id, set()).add(item.id)
         if item.entity_key is not None:
             self._index_ids_by_entity.setdefault(item.entity_key, {})[item.id] = None
+            self._index_ids_by_user_entity.setdefault(
+                (item.user_id, item.entity_key),
+                {},
+            )[item.id] = None
 
     def _discard_index_item(self, memory_id: str) -> None:
         item = self._index_items.pop(memory_id, None)
@@ -405,11 +413,22 @@ class PostgresStore(BaseStore):
                 entity_ids.pop(memory_id, None)
                 if not entity_ids:
                     self._index_ids_by_entity.pop(item.entity_key, None)
+            scoped_entity_ids = self._index_ids_by_user_entity.get(
+                (item.user_id, item.entity_key)
+            )
+            if scoped_entity_ids is not None:
+                scoped_entity_ids.pop(memory_id, None)
+                if not scoped_entity_ids:
+                    self._index_ids_by_user_entity.pop(
+                        (item.user_id, item.entity_key),
+                        None,
+                    )
 
     def _clear_index_items(self) -> None:
         self._index_items.clear()
         self._index_ids_by_user.clear()
         self._index_ids_by_entity.clear()
+        self._index_ids_by_user_entity.clear()
 
     def _scope_sql(self, user_id: str | None = None) -> tuple[str, list[Any]]:
         clauses: list[str] = []
@@ -1101,8 +1120,17 @@ class PostgresStore(BaseStore):
             await self._ensure_index()
         excluded = exclude_ids or set()
         items: list[MemoryItem] = []
+        scope = self._resolve_scope(user_id)
         for entity_key in dict.fromkeys(entity_keys):
-            for memory_id in self._index_ids_by_entity.get(entity_key, {}):
+            entity_ids = (
+                self._index_ids_by_entity.get(entity_key, {})
+                if scope is None
+                else self._index_ids_by_user_entity.get(
+                    (scope, entity_key),
+                    {},
+                )
+            )
+            for memory_id in entity_ids:
                 item = self._index_items.get(memory_id)
                 if item is None:
                     continue

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/docs/architecture.md

@@ -41,7 +41,8 @@ Three pipelines operate over the storage layer:
    NOOP operations with lineage and consistency results. Separately, the
    auto-linker mirrors each new write into graph indices; the consolidator
    merges dense semantic clusters into summaries that inherit *worst-case*
-   trust (no laundering); the pruner drops stale / redundant memories by
+   trust, including the weakest corroboration count (no laundering); the
+   pruner drops stale / redundant memories by
    policy.
 3. **Retrieval** — a query becomes an answer. The query is PII-redacted
    before embed. Query classifier picks graph weights; each graph produces
@@ -78,7 +79,9 @@ search, `DECIDE` (act/ask/abstain), and deletion — and because the chain
 is append-only, only the PII-processed form of a query is ever logged.
 `pii_action="encrypt"` fails closed: without a key the client refuses to
 initialize rather than store plaintext annotation originals.
-`forget_user` walks graph edges and signs the deletion set. The retention
+`forget_user` deletes the user's memories and the summaries derived from them,
+severs their graph edges, and signs the deletion set. It never deletes another
+user's memory through a shared edge. The retention
 manager applies typed TTLs and honors right-to-erasure requests. Isolation
 is a store predicate (`user_id` / `tenant_id` / `agent_id`), not a
 convention.

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pycontextdb"
-version = "0.4.3"
+version = "0.4.5"
 description = "The unified context layer for AI agents — memory you can act on without treating wishes as facts"
 readme = "README.md"
 license = "Apache-2.0"

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/tests/evals/test_trust_model.py

@@ -813,6 +813,42 @@ async def test_eval_7_1_forget_user_leaves_zero_residue(tmp_path: Path) -> None:
         await db.close()
 
 
+async def test_eval_7_2_forget_user_spares_other_users_sharing_an_entity(
+    tmp_path: Path,
+) -> None:
+    """EVAL-7.2: on a shared client, erasing one user must not delete another
+    user's memory because both mention the same entity."""
+    db = contextdb.init(
+        tenant_id="org-shared",
+        config=make_config(tmp_path, enable_entity_graph=True),
+    )
+    db._llm = MockLLM(
+        responses={"Extract": '{"entities": [{"name": "Acme", "type": "ORGANIZATION"}]}'}
+    )
+    try:
+        mine = await db.factual.add(
+            "Prefers Friday calls about the Acme account.",
+            source="user_stated",
+            user_id="alice",
+        )
+        theirs = await db.factual.add(
+            "Escalation contact for the Acme renewal.",
+            source="user_stated",
+            user_id="bob",
+        )
+        graph = db._graphs["entity"]
+        assert [nid for nid, _ in await graph.get_neighbors(mine.id)] == [theirs.id]
+
+        deleted = await db.forget_user("alice")
+
+        assert deleted == 1
+        assert await db.verify_forgotten("alice") is True
+        assert [m.id for m in await db.factual.list_facts(user_id="bob")] == [theirs.id]
+        assert await graph.get_neighbors(theirs.id) == []
+    finally:
+        await db.close()
+
+
 # ---------------------------------------------------------------------------
 # Epic 8 — Realtime + agent-host integrations
 # ---------------------------------------------------------------------------

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/tests/unit/test_evolution.py

@@ -22,9 +22,34 @@ async def test_consolidation_merges_with_worst_case_trust(client: ContextDB) ->
     assert summary.source == "consolidator"
     assert summary.epistemic_source == "third_party"
     assert summary.confidence == 0.4
-    assert summary.corroboration_count == 6
+    assert summary.corroboration_count == 1
     assert summary.action_relevant is True
     assert summary.metadata["consolidated_from"]
+    assert client.trust_policy.is_trusted(summary) is False
+
+
+async def test_consolidated_copies_of_one_rumor_still_require_confirmation(
+    client: ContextDB,
+) -> None:
+    """Five copies of one third-party rumor are one source, not five. The
+    summary must stay pending confirmation instead of passing the trust bar."""
+    copies = [
+        await client.factual.add(
+            "Forum post says the refund for the annual plan was approved.",
+            source="third_party",
+            action_relevant=True,
+        )
+        for _ in range(5)
+    ]
+    assert all(copy.requires_confirmation_under(client.trust_policy) for copy in copies)
+
+    summaries = await client.consolidate(min_cluster_size=5)
+
+    assert summaries, "identical copies should have merged"
+    summary = summaries[0]
+    assert summary.independent_corroboration == 1
+    assert summary.requires_confirmation_under(client.trust_policy)
+    assert await client.factual.recall_for_action("issue the annual plan refund") == []
 
 
 async def test_consolidation_screens_summary_for_injection(client: ContextDB) -> None:

{pycontextdb-0.4.3 → pycontextdb-0.4.5}/tests/unit/test_pg_sql.py

@@ -98,6 +98,16 @@ async def test_list_by_entities_filters_and_copies_only_the_requested_limit(
         )
         for index in range(20)
     ]
+    foreign = [
+        MemoryItem(
+            content=f"foreign-{index}",
+            entity_key="entity-a",
+            user_id="user-2",
+            tenant_id="tenant-1",
+            agent_id="agent-1",
+        )
+        for index in range(1_000)
+    ]
     future = MemoryItem(
         content="future",
         entity_key="entity-a",
@@ -106,13 +116,15 @@ async def test_list_by_entities_filters_and_copies_only_the_requested_limit(
         agent_id="agent-1",
         valid_from=now + timedelta(days=1),
     )
-    indexed = [*entity_b, future, *entity_a]
+    indexed = [*foreign, *entity_b, future, *entity_a]
     for item in indexed:
         store._cache_index_item(item)
     store._index_loaded = True
 
     original_model_copy = MemoryItem.model_copy
+    original_scope_allows = store._item_scope_allows
     copies = 0
+    scope_checks = 0
 
     def counted_model_copy(
         self: MemoryItem,
@@ -125,6 +137,13 @@ async def test_list_by_entities_filters_and_copies_only_the_requested_limit(
         return original_model_copy(self, update=update, deep=deep)
 
     monkeypatch.setattr(MemoryItem, "model_copy", counted_model_copy)
+
+    def counted_scope_allows(item: MemoryItem, user_id: str | None) -> bool:
+        nonlocal scope_checks
+        scope_checks += 1
+        return original_scope_allows(item, user_id)
+
+    monkeypatch.setattr(store, "_item_scope_allows", counted_scope_allows)
     results = await store.list_by_entities(
         ["entity-a", "entity-b"],
         user_id="user-1",
@@ -135,6 +154,7 @@ async def test_list_by_entities_filters_and_copies_only_the_requested_limit(
 
     assert len(results) == 5
     assert copies == 5
+    assert scope_checks == 7
     assert all(item.entity_key == "entity-a" for item in results)
     assert entity_a[0].id not in {item.id for item in results}
     results[0].metadata["nested"].append(99)
@@ -238,6 +258,12 @@ def test_postgres_secondary_indexes_follow_cache_lifecycle() -> None:
     }
     assert list(store._index_ids_by_entity["entity-a"]) == [first.id]
     assert list(store._index_ids_by_entity["entity-b"]) == [second.id]
+    assert list(store._index_ids_by_user_entity["user-1", "entity-a"]) == [
+        first.id
+    ]
+    assert list(store._index_ids_by_user_entity["user-2", "entity-b"]) == [
+        second.id
+    ]
 
     replacement = first.model_copy(
         update={"user_id": "user-3", "entity_key": "entity-c"}
@@ -245,18 +271,24 @@ def test_postgres_secondary_indexes_follow_cache_lifecycle() -> None:
     store._cache_index_item(replacement)
     assert "user-1" not in store._index_ids_by_user
     assert "entity-a" not in store._index_ids_by_entity
+    assert ("user-1", "entity-a") not in store._index_ids_by_user_entity
     assert store._index_ids_by_user["user-3"] == {first.id}
     assert list(store._index_ids_by_entity["entity-c"]) == [first.id]
+    assert list(store._index_ids_by_user_entity["user-3", "entity-c"]) == [
+        first.id
+    ]
 
     store._discard_index_item(first.id)
     assert "user-3" not in store._index_ids_by_user
     assert "entity-c" not in store._index_ids_by_entity
+    assert ("user-3", "entity-c") not in store._index_ids_by_user_entity
     assert first.id not in store._index_items
 
     store._clear_index_items()
     assert store._index_items == {}
     assert store._index_ids_by_user == {}
     assert store._index_ids_by_entity == {}
+    assert store._index_ids_by_user_entity == {}
 
 
 @pytest.mark.asyncio