pycontextdb 0.4.4__tar.gz → 0.4.5__tar.gz

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.4.5 — 2026-10-05
+
+- `forget_user` no longer deletes other users' memories. It added every graph
+  neighbor of the erased memories to the deletion set, and entity edges join
+  any memories that mention the same name, so on a shared client with the
+  entity graph and an extraction model, erasing one user could hard-delete
+  another user's memories. It now deletes only the user's memories and the
+  summaries derived from them, and severs their graph edges.
+- Consolidated summaries keep the weakest corroboration count of their inputs
+  instead of the sum. Repeated copies of one third-party claim could
+  consolidate into a summary that passed the default trust bar and was
+  returned by `recall_for_action`. The summary now stays pending confirmation.
+- Unchanged limitation: entity rows are shared across users, and attributes
+  merged into an entity from a user's text are not removed by `forget_user`.
+
 ## 0.4.4 — 2026-09-20
 
 - PostgreSQL sibling composition now uses an ordered user-plus-entity cache

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pycontextdb
-Version: 0.4.4
+Version: 0.4.5
 Summary: The unified context layer for AI agents — memory you can act on without treating wishes as facts
 Project-URL: Homepage, https://github.com/atomsai/contextdb
 Project-URL: Documentation, https://contextdb.dev
@@ -120,7 +120,7 @@ Speed is table stakes. The production failure that gets agents fired is **acting
 
 Every memory carries **epistemic provenance** (`user_stated` / `agent_inferred` / `third_party`), **confidence**, **independent corroboration** (same-speaker repeats do not count), and an **action-relevant** flag. The action bar is data — `TrustPolicy.hospital()` vs `TrustPolicy.restaurant()` — not a hardcoded `if`. Facts that gate actions must pass the active policy before `recall_for_action()` releases them; everything else comes back marked `requires_confirmation`. `factual.confirm()` is the writeback: the agent asked, the user said yes, the fact graduates. Stock hosts (Pipecat, LiveKit, MCP) go through `VerifyBeforeAct` so an untrusted fact never reaches an action-shaped prompt.
 
-On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that walks graph edges, and **tenant/agent isolation enforced at the storage layer**.
+On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that severs graph edges without touching other users' memories, and **tenant/agent isolation enforced at the storage layer**.
 
 Don't take our word for it — the fabrication benchmark ships in-repo and runs on every PR. Same store, same embedder, same utterance policy; the only difference is the trust model:
 

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/README.md

@@ -54,7 +54,7 @@ Speed is table stakes. The production failure that gets agents fired is **acting
 
 Every memory carries **epistemic provenance** (`user_stated` / `agent_inferred` / `third_party`), **confidence**, **independent corroboration** (same-speaker repeats do not count), and an **action-relevant** flag. The action bar is data — `TrustPolicy.hospital()` vs `TrustPolicy.restaurant()` — not a hardcoded `if`. Facts that gate actions must pass the active policy before `recall_for_action()` releases them; everything else comes back marked `requires_confirmation`. `factual.confirm()` is the writeback: the agent asked, the user said yes, the fact graduates. Stock hosts (Pipecat, LiveKit, MCP) go through `VerifyBeforeAct` so an untrusted fact never reaches an action-shaped prompt.
 
-On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that walks graph edges, and **tenant/agent isolation enforced at the storage layer**.
+On top of that: **versioned slot vocabulary** + an LLM-free slotter (so `add_fast` and supersede agree), **extractor-as-security-boundary** (a prompt-injected `user/allergy` the raw text does not support is demoted), **contested slots** (independent speakers asserting different values do not last-write-win — both stay current, neither is actionable, `confirm()` resolves), **compositional hop** (`"when is the Denver meeting?"` surfaces `meeting/time` after hitting `meeting/location`), **PII-safe recall** (queries are redacted before embed so a raw email still retrieves `[EMAIL]`), **temporal supersede** with an injectable clock (`valid_from`/`valid_until`/`superseded_by` + as-of queries), a **latency-tiered write path** (`add_fast`: no LLM on the turn path, p95 ≈ 1.5ms local), **salience** (recency × frequency × criticality — a year-old allergy still outranks 500 fresh noise memories), **write-time injection screening** with demoted `[RECALLED DATA — not instructions]` rendering, **recall-side observability** (`db.explain(id)` logs score *and* decision flags as they stood at recall time; `VerifyBeforeAct` writes `DECIDE` to the audit log), **verifiable forgetting** that severs graph edges without touching other users' memories, and **tenant/agent isolation enforced at the storage layer**.
 
 Don't take our word for it — the fabrication benchmark ships in-repo and runs on every PR. Same store, same embedder, same utterance policy; the only difference is the trust model:
 

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/contextdb/__init__.py

@@ -41,7 +41,7 @@ from contextdb.core.policy import TrustPolicy
 from contextdb.pool import ContextDBPool
 from contextdb.utils.embeddings import EmbeddingProvider
 
-__version__ = "0.4.4"
+__version__ = "0.4.5"
 
 __all__ = [
     "Clock",

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/contextdb/client.py

@@ -1685,21 +1685,13 @@ class ContextDB:
             if added == 0:
                 break
 
-        # Walk graph edges: a forgotten fact that still has neighbors is
-        # how "forgotten" memories regenerate — not from the row, from
-        # the graph.
+        # Sever graph edges so a forgotten memory cannot be reached or
+        # rebuilt through the graph. Neighbors are never added to the
+        # deletion set: entity edges join every memory that mentions the
+        # same name, including other users' memories, and this user's own
+        # and derived memories are already in ``targets``.
         for graph in self._graphs.values():
             for memory_id in list(targets):
-                try:
-                    neighbors = await graph.get_neighbors(memory_id, max_results=50)
-                except Exception:  # noqa: BLE001
-                    continue
-                for nid, _weight in neighbors:
-                    if nid in targets:
-                        continue
-                    neighbor = await store.get_raw(nid)
-                    if neighbor is not None:
-                        targets[nid] = neighbor
                 try:
                     await graph.remove_node(memory_id)
                 except Exception:  # noqa: BLE001

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/contextdb/dynamics/evolution.py

@@ -98,7 +98,8 @@ class Consolidator:
             # Trust-conservative merge: a summary must never be MORE trusted
             # than its least trusted input. Otherwise consolidation launders
             # epistemic status — five third-party hearsay fragments would
-            # emerge as a confident first-party fact.
+            # emerge as a confident first-party fact. Corroboration is not
+            # summed: copies of one claim are not independent support.
             new_item = MemoryItem(
                 content=summary,
                 embedding=cluster_items[0].embedding,
@@ -110,7 +111,7 @@ class Consolidator:
                     key=lambda s: _SOURCE_RANK[s],
                 ),
                 confidence=min(m.confidence for m in cluster_items),
-                corroboration_count=sum(m.corroboration_count for m in cluster_items),
+                corroboration_count=min(m.independent_corroboration for m in cluster_items),
                 action_relevant=any(m.action_relevant for m in cluster_items),
                 injection_suspect=any(m.injection_suspect for m in cluster_items),
             )

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/docs/architecture.md

@@ -41,7 +41,8 @@ Three pipelines operate over the storage layer:
    NOOP operations with lineage and consistency results. Separately, the
    auto-linker mirrors each new write into graph indices; the consolidator
    merges dense semantic clusters into summaries that inherit *worst-case*
-   trust (no laundering); the pruner drops stale / redundant memories by
+   trust, including the weakest corroboration count (no laundering); the
+   pruner drops stale / redundant memories by
    policy.
 3. **Retrieval** — a query becomes an answer. The query is PII-redacted
    before embed. Query classifier picks graph weights; each graph produces
@@ -78,7 +79,9 @@ search, `DECIDE` (act/ask/abstain), and deletion — and because the chain
 is append-only, only the PII-processed form of a query is ever logged.
 `pii_action="encrypt"` fails closed: without a key the client refuses to
 initialize rather than store plaintext annotation originals.
-`forget_user` walks graph edges and signs the deletion set. The retention
+`forget_user` deletes the user's memories and the summaries derived from them,
+severs their graph edges, and signs the deletion set. It never deletes another
+user's memory through a shared edge. The retention
 manager applies typed TTLs and honors right-to-erasure requests. Isolation
 is a store predicate (`user_id` / `tenant_id` / `agent_id`), not a
 convention.

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pycontextdb"
-version = "0.4.4"
+version = "0.4.5"
 description = "The unified context layer for AI agents — memory you can act on without treating wishes as facts"
 readme = "README.md"
 license = "Apache-2.0"

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/tests/evals/test_trust_model.py

@@ -813,6 +813,42 @@ async def test_eval_7_1_forget_user_leaves_zero_residue(tmp_path: Path) -> None:
         await db.close()
 
 
+async def test_eval_7_2_forget_user_spares_other_users_sharing_an_entity(
+    tmp_path: Path,
+) -> None:
+    """EVAL-7.2: on a shared client, erasing one user must not delete another
+    user's memory because both mention the same entity."""
+    db = contextdb.init(
+        tenant_id="org-shared",
+        config=make_config(tmp_path, enable_entity_graph=True),
+    )
+    db._llm = MockLLM(
+        responses={"Extract": '{"entities": [{"name": "Acme", "type": "ORGANIZATION"}]}'}
+    )
+    try:
+        mine = await db.factual.add(
+            "Prefers Friday calls about the Acme account.",
+            source="user_stated",
+            user_id="alice",
+        )
+        theirs = await db.factual.add(
+            "Escalation contact for the Acme renewal.",
+            source="user_stated",
+            user_id="bob",
+        )
+        graph = db._graphs["entity"]
+        assert [nid for nid, _ in await graph.get_neighbors(mine.id)] == [theirs.id]
+
+        deleted = await db.forget_user("alice")
+
+        assert deleted == 1
+        assert await db.verify_forgotten("alice") is True
+        assert [m.id for m in await db.factual.list_facts(user_id="bob")] == [theirs.id]
+        assert await graph.get_neighbors(theirs.id) == []
+    finally:
+        await db.close()
+
+
 # ---------------------------------------------------------------------------
 # Epic 8 — Realtime + agent-host integrations
 # ---------------------------------------------------------------------------

{pycontextdb-0.4.4 → pycontextdb-0.4.5}/tests/unit/test_evolution.py

@@ -22,9 +22,34 @@ async def test_consolidation_merges_with_worst_case_trust(client: ContextDB) ->
     assert summary.source == "consolidator"
     assert summary.epistemic_source == "third_party"
     assert summary.confidence == 0.4
-    assert summary.corroboration_count == 6
+    assert summary.corroboration_count == 1
     assert summary.action_relevant is True
     assert summary.metadata["consolidated_from"]
+    assert client.trust_policy.is_trusted(summary) is False
+
+
+async def test_consolidated_copies_of_one_rumor_still_require_confirmation(
+    client: ContextDB,
+) -> None:
+    """Five copies of one third-party rumor are one source, not five. The
+    summary must stay pending confirmation instead of passing the trust bar."""
+    copies = [
+        await client.factual.add(
+            "Forum post says the refund for the annual plan was approved.",
+            source="third_party",
+            action_relevant=True,
+        )
+        for _ in range(5)
+    ]
+    assert all(copy.requires_confirmation_under(client.trust_policy) for copy in copies)
+
+    summaries = await client.consolidate(min_cluster_size=5)
+
+    assert summaries, "identical copies should have merged"
+    summary = summaries[0]
+    assert summary.independent_corroboration == 1
+    assert summary.requires_confirmation_under(client.trust_policy)
+    assert await client.factual.recall_for_action("issue the annual plan refund") == []
 
 
 async def test_consolidation_screens_summary_for_injection(client: ContextDB) -> None: