sidegraph 0.10.0__tar.gz → 0.11.1__tar.gz

{sidegraph-0.10.0 → sidegraph-0.11.1}/.github/workflows/ci.yml

@@ -28,6 +28,7 @@ jobs:
       # leak them.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          fetch-depth: 0   # committed-history secret scan needs every reachable commit
           persist-credentials: false
 
       - name: Install uv
@@ -49,6 +50,27 @@ jobs:
       - name: Run pre-commit checks
         run: uv run pre-commit run --all-files
 
+      - name: Scan committed history for secrets
+        run: |
+          test "$(git rev-parse --is-shallow-repository)" = false
+          uv run pre-commit run gitleaks-history --hook-stage manual --all-files
+
+      - name: Exercise secret scanner integration
+        env:
+          SIDEGRAPH_SECRET_SCAN_INTEGRATION: "1"
+        run: |
+          uv run pytest tests/test_secret_scan_gate.py -q --junitxml="$RUNNER_TEMP/secret-scan.xml"
+          python3 - <<'PY'
+          import os
+          from pathlib import Path
+          from xml.etree import ElementTree
+
+          report = Path(os.environ["RUNNER_TEMP"]) / "secret-scan.xml"
+          suites = list(ElementTree.parse(report).getroot().iter("testsuite"))
+          assert sum(int(s.attrib["tests"]) for s in suites) > 0, "no scanner tests ran"
+          assert sum(int(s.attrib["skipped"]) for s in suites) == 0, "scanner tests skipped"
+          PY
+
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 30

{sidegraph-0.10.0 → sidegraph-0.11.1}/.pre-commit-config.yaml

@@ -71,6 +71,16 @@ repos:
     rev: v8.30.1
     hooks:
       - id: gitleaks
+        # Filename exclusions protect immutable files from formatters, not this scanner:
+        # its upstream entry reads the staged Git index without filtered filenames.
+        always_run: true
+        stages: [pre-commit]
+      - id: gitleaks
+        alias: gitleaks-history
+        name: Detect hardcoded secrets in committed history
+        entry: gitleaks git --redact "--log-opts=--diff-merges=first-parent HEAD" --verbose
+        always_run: true
+        stages: [manual]
 
   # Finds GitHub Actions supply-chain/security issues (unpinned actions, script injection via
   # untrusted `${{ }}` template interpolation, excessive `permissions:`) in the workflows that

{sidegraph-0.10.0 → sidegraph-0.11.1}/AGENTS.md

@@ -31,8 +31,9 @@ Tests/fixtures: `tests/`; plugin skills/configuration in `plugin/sidegraph/`.
 Python 3.13+; `uv`:
 
 - `uv sync --locked`: install dependencies.
-- `uv run pytest tests/test_store.py -q`: focused tests.
-- `uv run pytest -q`: full suite; CI covers 3.13/3.14.
+- `uv run pytest tests/test_store.py -q`: the touched test file while editing (`-x`, `--lf`).
+- `uv run pytest -m "not slow"`: the broader pre-push check; skips the subprocess-heavy tests, but still takes minutes.
+- `uv run pytest -q`: full suite; run it once before a commit or PR, not while editing. CI runs it again (3.13/3.14).
 - `uv run pre-commit run --all-files`: shared lint/format/type/secret-scanning gate (also
   runs `gitleaks`, `detect-private-key`, `zizmor`, `actionlint`, `check-toml`, and a
   `uv.lock`-in-sync check).

{sidegraph-0.10.0 → sidegraph-0.11.1}/CHANGELOG.md

@@ -7,6 +7,264 @@ interfaces, exactly, and what each one promises: [`docs/reference/stability.md`]
 
 ## [Unreleased]
 
+## [0.11.1] — 2026-10-10
+
+### Fixed
+
+- **Bootstrap excludes special files and validates one bounded regular descriptor.** FIFO,
+  sockets and devices cannot become selected text sources, including through `--include`.
+  Available nonblocking/no-follow flags guard final-component replacement; the opened
+  descriptor is rechecked before strict incremental UTF-8 validation. Directory aliases
+  are rechecked against exclusions. Include retains its size override but observed growth
+  past opened size is excluded. Later planner/apply reads and ancestor races retain their
+  existing scope.
+
+- **Git verification preserves unusual filenames through binary NUL framing.** Verify and
+  doctor detect immutable edits and archive deletions at paths containing Unicode, TAB,
+  LF, CR, quotes, backslashes or surrounding whitespace. Malformed or unsupported diff
+  output is an operational error (exit `1`), never a partial clean report. Shared Git
+  callers keep their decoded-text behavior; only diff reads raw pathname bytes.
+
+- **Git verification resolves `--against` to one protected, frozen commit ID.** Verify and
+  doctor reject option-shaped, empty, NUL-containing, unavailable and non-commit baselines
+  operationally (exit `1`). Diff and every baseline record read use the same full SHA-1 or
+  SHA-256 ID, so a branch moving between those operations cannot hide an immutable edit.
+  There is no raw-ref fallback. Current working-tree reads retain
+  their existing concurrency limits.
+
+- **Malformed write diagnostics omit raw input and arbitrary failure causes.** Capture
+  errors use bounded schema fields/codes; logical MCP writes apply raw admission before
+  signature coercion and intercept exceptions before framework warning/error logging.
+  Unknown write arguments keep valid parameter help without echoing their names.
+  Unsupported registrations fail closed. Partial-write warnings and recovery guidance
+  remain truthful; domain/ratify causes are controlled. Read diagnostics and upstream
+  FastMCP DEBUG argument tracing retain their existing scope.
+
+- **Capture and direct writes reject oversized input before redaction or canonical writes.**
+  Limits are 256 KiB UTF-8 per string, 4 MiB admitted strings and 65,536 admitted nodes per
+  request, depth 32 and 4,096 nodes per draft, and 100 agent drafts including attached facts.
+  Combined decisions/facts share one budget; item violations reject the containing draft,
+  while request-wide violations fail before any write. Documents have an independent 8 MiB
+  per-file limit with whole-file skips, matching real/dry reports and no total-import cap.
+  Import tags and free-text options are bounded separately; input is never silently truncated.
+  Raw Python batches use lists/tuples; supported scalar, mapping and model fields are
+  inspected. Other opaque Python values (including sets, deques, generators and non-string
+  Enum objects) are rejected before Pydantic coercion, without consuming iterators. Numeric
+  enums can become strings rather than behave as numbers in Pydantic string fields; only
+  string-derived enums keep their measured base-string behavior.
+- **Redaction avoids repeated suffix searches in four known attack families.** Linear
+  assignment-key, URL-credential, JWT and private-key-block recognizers preserve matching
+  order/counts and the existing conservative quoted-value behavior. This does not claim
+  universal regex linearity or complete secret detection. See [security policy](SECURITY.md).
+
+- **Secret-bearing tags are redacted before document import stores their slugs.** Capture,
+  direct MCP writes and document import share tag normalization. Import reports tag
+  substitutions once per batch in real and dry runs, including duplicate raw tags.
+  Comma-separated MCP strings are cleaned before splitting; a secret-bearing string with
+  commas drops all its tags conservatively. List input keeps explicit boundaries.
+
+- **Quoted assignment redaction consumes multiline, triple-quoted and unterminated values.**
+  Escaped closers and glued tails stay covered. An unterminated value removes the
+  remaining input conservatively if no legal closer is found. An assignment span,
+  including URL/card expansion, that would swallow another assignment's key also consumes
+  the remaining input and following prose. A multiline quoted span splitting a URL
+  credential or checksum-valid grouped card number does so too. Bare values and
+  single-line glued tails extend through crossing URL/card matches while otherwise
+  preserving later prose. Prior tag entities and Git history remain: review old tags and
+  rotate exposed credentials. Unicode letters/digits after a single quote keep it inside
+  the value as an apostrophe; an unclosed value removes the remainder.
+
+- **Secret scanning covers store-only commits and committed CI history.** The pinned
+  Gitleaks hook runs even when changed files are excluded from formatting. A separate manual
+  `gitleaks-history` hook scans committed HEAD history, also run by CI with a full checkout.
+  Scanner integration tests exercise staged, committed, and removed synthetic secrets.
+
+- **Store verification checks the content of newly archived history.** A matching archive ID
+  alone no longer permits deletion of a committed hot decision or domain: every archive copy
+  must be compactable and a legal transition from the baseline, preserving raw immutable keys.
+  The snapshot check also reports nonterminal archive records. Legal supersede/drop followed
+  by compaction, older absent `null`/empty defaults, identical merge copies, and crash cleanup
+  still pass.
+
+### Changed
+
+- **Security documentation states the limits explicitly.** The privacy overview describes
+  best-effort redaction and writes outside the store. CLI documentation distinguishes
+  argument syntax errors from rejected Git baselines and recommends JSON output when
+  a terminal cannot encode a reported pathname.
+
+## [0.11.0] — 2026-10-09
+
+### Changed
+
+- **`index.db` no longer creates and deletes its journal in every write transaction.** SQLite's
+  default rollback mode (`DELETE`) created `index.db-journal` at the start of each write and
+  removed it at the end, and the hooks write on every tool call, so one store produced
+  hundreds of thousands of file-system events an hour. Every connection that writes now runs
+  `journal_mode=TRUNCATE`: the same rollback journal, locking and crash safety, but the journal
+  is emptied rather than deleted, so a 0-byte `index.db-journal` stays beside `index.db`
+  (gitignored by `index.db*`, as before). Each transaction still writes, truncates and syncs
+  that file, so the events do not vanish: they fall most for back-to-back writes (tests, bulk
+  imports: about nine times fewer on the journal) and by about a third for hook traffic.
+  Read-only connections still write nothing, and there is normally no `-wal`/`-shm`; an index
+  that another connection has pinned in WAL stays in WAL, which Sidegraph tolerates. A crash
+  mid-transaction still leaves a non-empty journal that the next writer rolls back.
+
+### Fixed
+
+- **The `UNANCHORED` line of `sidegraph-bootstrap` now names the graph in use.** It always said
+  to run `graphify update .`, which rebuilds only the default graph, so with `--graph` or
+  `$SIDEGRAPH_GRAPH` elsewhere the advice could not make the next run write the document. It now
+  uses the same step as the `ANCHORS` line: `rebuild the graph at <path> and rerun` for a custom
+  graph, `run `graphify update .` and rerun` for the default one.
+- **A fresh `sidegraph-bootstrap` run now lists the store's creation marker as changed.** The
+  `CHANGED` lines and `--report` named `format` and `.gitignore` but not the committed
+  `stamping_live_since` file the same run created.
+- **`sidegraph-bootstrap` now says what is wrong when a ratified or revived record is out of the
+  graph's reach.** For an accepted candidate with no anchor in the current graph whose content
+  is already stored (ratified in place, or revived from a rejected record), every rerun used to
+  print `ANCHORS incomplete: accepted candidate has unresolved or ambiguous anchors`,
+  `PROOF incomplete: selected decision did not surface` and a `RESUME` line that could never
+  succeed, and exit 2. The anchors are now judged by whether the
+  record still surfaces through production retrieval, the same test as `PROOF`: when it does
+  not, the run still exits 2 but prints ``ANCHORS      incomplete: stored record <id> for
+  <source> has no anchor in the current graph; run `graphify update .` and rerun``, a matching
+  `PROOF` reason and a `NEXT` line with that command instead of `RESUME`; once the graph has the
+  node, the rerun exits 0. The exact `RESUME` stays when something a resume can fix (a failed
+  write, missing host wiring) is also wrong, and with `--graph` the line names the graph to
+  rebuild instead. The `--report` file carries the same remedy. A written record with an
+  unresolved backticked mention keeps its old message.
+- **A directory named like a record no longer makes the whole store unopenable.** A directory
+  (or a dangling or looping symlink) called `.x.json`, or `01ABC.json`, in `decisions/`,
+  `facts/`, `domains/`, `entities/` or `initiatives/` (or in `bindings/` under a safe name, or
+  `archive/` as `*.jsonl`) crashed every open of the store, so every hook and MCP call failed
+  (`IsADirectoryError` for a directory, `Too many levels of symbolic links` for a looping
+  link), and a FIFO there blocked the open for ever. The reload now skips any entry that is not
+  a regular file before reading it, lists it in the skipped files with the reason `not a
+  regular file`, and the startup warning names it; the other records load and the next open
+  takes the fast path. `sidegraph-verify` reports such an entry once, as `unsafe-record-id`
+  for an unsafe record name and as `parse-error` (`bad-archive-segment` in `archive/`,
+  whatever the segment's name) otherwise, and no longer blocks on a FIFO, including
+  `--against` when a tracked file was replaced by one. A stale directory or looping symlink
+  named `*.tmp` no longer fails the open either. `sidegraph-stats` no longer ends in a
+  traceback on a looping link, and no longer reports the index as behind for ever because of a
+  dangling symlink. The skip reason for a file with an unsafe name now says `unsafe filename`
+  instead of "id 'A' does not match the filename".
+- **`sidegraph-prepare-commit-msg` no longer leaves its candidate block in `git commit -m`
+  messages under the `pre-commit` framework.** The framework passes the hook only the message
+  file and hands git's source in `PRE_COMMIT_COMMIT_MSG_SOURCE`, so the hook always saw "source
+  absent" and wrote its `# Sidegraph: uncomment the trailers…` and `# Sidegraph-Decision: …`
+  lines, which `-m` commits keep. With exactly one argument the hook now reads the source from
+  that variable (unset or empty means a plain commit); with two or three arguments, as raw git
+  passes them, the arguments still win.
+- **The hook entry points answer `--help` instead of running.** `sidegraph-session-start --help`
+  ran the SessionStart hook in the current directory and wrote into its `index.db`, and the other
+  three hook scripts (`sidegraph-stop`, `sidegraph-pre-tool-use`, `sidegraph-subagent-start`)
+  ignored their arguments the same way, while `sidegraph-prepare-commit-msg --help` printed
+  nothing and `sidegraph-mcp --help` started the server. Each now prints a short usage text for
+  `-h` or `--help` and exits 0 before it reads stdin, opens the store or writes anything. Any
+  other argument to a hook script is a usage error on stderr with exit 2. The git hook
+  `sidegraph-prepare-commit-msg` stays fail-open: it prints the same error for an unknown option
+  or a fourth argument but exits 0 and leaves the message untouched, so `git commit` never fails
+  because of a stray `args:` entry; git's one to three positional arguments are unchanged. Hosts call the hook scripts without
+  arguments, so nothing a host runs changes.
+- **`sidegraph-bootstrap` now converges when an accepted candidate has no anchor.** A document
+  with no backticked symbol and no node in the graph (typically one newer than the last graph
+  build) was never written, yet stayed pending: every run, `--resume` included, ended
+  `partial-recoverable` or `incomplete` with exit 2 and a `FAILED REF <none>` the operator
+  could not act on. Review now flags it with a `no-anchor` warning, and apply skips it by name
+  on an `UNANCHORED` line with its source path (`skipped_unanchorable_keys` in the report object)
+  and counts it as neither durable nor pending, so it no longer keeps the run partial. A run
+  where every approved candidate is skipped this way writes no record and ends as a diagnostic
+  that exits 0. It keeps the checks a run with records has, except the anchor and proof ones:
+  the store reopens and verifies clean, the host integration is verified, and `--report` is
+  written. A missing host integration or a store violation exits 2 instead (`STORE
+  incomplete`, with `RESUME`, or `sidegraph-verify` for a violation), as does an anchored
+  candidate kept proposed. Run `graphify update .` (or rebuild the `--graph` file) and the next
+  run writes it.
+  `sidegraph-import` is unchanged.
+- **`sidegraph-verify` now reports a domain whose `parent_id` is not a domain, or whose parent
+  chain loops.** The store refuses to write either, but a hand-edited domain with
+  `parent_id: "not-a-domain"` passed `sidegraph-verify` and `sidegraph-doctor` with exit 0. A
+  `parent_id` that names no domain, hot or archived, is now a `dangling-parent`, and a parent
+  chain that comes back to itself (a domain that is its own parent included) is one
+  `parent-cycle` per cycle, at the domain with the smallest id on it. A superseded, dropped or
+  compacted parent still counts as existing, so a history written through the tools stays
+  clean, and a parent held by a file skipped for its name is not reported twice. A non-string
+  `parent_id` stays a `parse-error` (a `bad-archive-segment` in an archive segment).
+- **A record directory the process cannot list or search is reported as unreadable, not as
+  missing records.** With `decisions/` at mode 000, `sidegraph-verify` printed a
+  `dangling-fact-support` for every fact and `--against` an `illegal-deletion` for every
+  record, as if the store had been tampered with. `sidegraph-verify` and `sidegraph-doctor` now
+  stop with one `store not readable` line naming the directory and exit 1, before any
+  cross-reference or deletion check runs. `sidegraph-stats` likewise says `cannot read the
+  store index` instead of `no store index` when the store directory cannot be searched, and no
+  longer ends in a traceback when a record directory cannot be listed. An empty record
+  directory without the search bit is reported the same way.
+- **`sidegraph-verify` reports only `unsafe-record-id` for a record file the store skips for
+  its name or id.** A copy such as `decisions/.x.json` was also reported as
+  `filename-id-mismatch` and `duplicate-ulid`, and a file with a safe name but an unsafe id as
+  `filename-id-mismatch` too, though the store never indexes either. A file with an unsafe
+  name that was not valid JSON, not UTF-8 or not an object showed only `parse-error`, and the
+  same went for a `bindings/` file that was not a JSON list, so the real problem, the name,
+  went unreported. The name is now checked before the content, in every record directory. A
+  file skipped for its name no longer counts as a second copy of a record, but a record that
+  points at its id is not reported either: renaming the file back is the only fix.
+- **`sidegraph-compact` no longer warns "DIFFERENT content" for a hot file that only lacks
+  newer keys.** A decision or domain written before `ratified_at`, `ratified_by` or
+  `provenance.commit` existed has no such keys, while its archive line, dumped from the model,
+  carries them as `null`. The raw comparison read that as a difference, kept the hot file and
+  repeated the warning on every index rebuild and every later compact. The visible damage was
+  that `sidegraph-verify` then exited 2 with a `duplicate-ulid` for each kept hot file, so the
+  store-lint gate failed after a compact. A key the hot file lacks now matches an explicit
+  `null` or an empty list or object in the archive, recursively, as `sidegraph-verify
+  --against` already treats it. The match is one-directional: a key only the hot file holds, at
+  any depth and whatever its value, still warns and keeps the file, so a field written by a
+  newer version is never lost to a compact by an older one.
+- **`sidegraph-doctor` keeps its `auto share` and `auto supersede rate` lines on a hand-edited
+  archived record.** An archived decision, a fact or a domain whose `status` was a list or a
+  dict made the auto-share tally raise, and doctor swallowed the error and dropped both lines
+  without a word. The bad value now counts as not retired and the lines print. Any other error
+  in the ratification lines is no longer swallowed.
+- **`sidegraph-verify` no longer crashes on a non-string `supersedes`.** A hand-edited record
+  whose `supersedes` was a list or a dict ended the run with a `TypeError` and lost every
+  other violation. The bad value is now reported as the violation it is and the run goes on.
+- **`sidegraph-verify` no longer crashes on an unhashable `supports` item, a status in
+  `--against`, or the malformed id of a deleted record.** Each used a raw hand-edited value as a
+  set member or lookup key; the run died with exit 1 where it should find the violation and exit
+  2. A malformed old status in `--against` is now reported as an illegal status jump.
+- **A symlinked store directory now stops `sidegraph-verify` and `sidegraph-doctor` at the
+  link.** Verify reported the link but still read through it: `facts -> decisions` linted every
+  decision as a fact, a link out of the store linted foreign files, and a linked-out `entities`,
+  `decisions` or `archive` made references into it look dangling. Both commands now report the
+  `symlinked-store-entry` findings, skip every other check (doctor's advisory checks and
+  `--against` included) and print one line saying so in text output; the exit code stays 2. An
+  `--against` ref that does not resolve, or a store outside git, is still checked first and exits
+  1 without reporting the links. A
+  symlinked `format` marker is no longer read, so its target's text cannot reach a CI log. A bindings file with
+  an unsafe name no longer also reports its entities as dangling, since the store skips that
+  file whole.
+- **`sidegraph-verify` and `sidegraph-doctor` report a store directory they cannot search as
+  `store not readable` on every Python.** With the store directory (or a parent) lacking the
+  search bit, for example `chmod 000` or `chmod 600 .sidegraph`, Python 3.14 reported
+  `unknown-schema-version … format marker missing` or `store directory not found` with exit 2
+  or 1, which read as a bad schema version or a missing store; Python 3.13 already printed
+  `store not readable (…)` with exit 1. Both commands now look the directory and its `format`
+  marker up with `os.stat`/`os.lstat`, which raise on every Python, and take the exit-1 path.
+  A directory that is searchable but not listable (`chmod 300`) is still checked normally.
+  The MCP `verify_store` tool now raises on 3.14 as it did on 3.13 instead of reporting
+  `unknown-schema-version`, and a store path that is a symlink loop reports the OS error
+  (`Too many levels of symbolic links`) instead of `store directory not found`, still with
+  exit 1.
+- **`sidegraph-doctor` no longer crashes on a list or dict `status` or `entity_id`.** A
+  hand-edited decision whose `status` was a list or a dict, or an anchor-set entry whose
+  `entity_id` was one, made the dangling-record, unreferenced-entity, expired-open-validity,
+  never-surfaced and code-drift checks raise a `TypeError`. The run exited 1 and lost the whole
+  report, including the `parse-error` that `sidegraph-verify` found for the same file, and the
+  hooks that swallow the error silently switched the code-drift line off for every record. The
+  bad value is now skipped by those checks and reported once, by the model check, so the run
+  exits 2 with the rest of its findings.
+
 ## [0.10.0] — 2026-10-04
 
 ### Added

{sidegraph-0.10.0 → sidegraph-0.11.1}/CLAUDE.md

@@ -13,7 +13,7 @@ task-aware retrieval + decision memory riding on the engine's entity graph.
 continuing participant in the project. A core feature must preserve, organize, or deliver
 accumulated project understanding. Document search by itself is not the product.
 
-Sidegraph is pre-1.0 (v0.10.0) — the full loop (capture, ratification, mistakes-first
+Sidegraph is pre-1.0 (v0.11.1) — the full loop (capture, ratification, mistakes-first
 retrieval, refactor-surviving re-anchoring, semantic docs layer, mind-model domains, and the
 facts evidence layer) ships and is exercised end-to-end, but interfaces may still move before
 a stable release. See
@@ -98,8 +98,9 @@ See [`docs/concepts/data-model.md`](docs/concepts/data-model.md) for the record
 ```bash
 uv sync                            # install deps into .venv
 uv run pre-commit install          # once per clone — the lint gate runs before each commit
-uv run pytest                      # run tests
-uv run pytest tests/test_store.py -q
+uv run pytest tests/test_store.py -q   # while editing: the touched file (-x, --lf)
+uv run pytest -m "not slow"         # broader pre-push check: skips subprocess-heavy tests, still minutes
+uv run pytest                      # full suite: once before a commit or PR (CI runs it again)
 uv run pre-commit run --all-files  # lint + format + types, exactly what CI runs
 uv run sidegraph-mcp               # run the decision MCP server (stdio)
 ```

{sidegraph-0.10.0 → sidegraph-0.11.1}/CONTRIBUTING.md

@@ -20,10 +20,33 @@ consequence for you:
 git clone https://github.com/SantyagoSeaman/sidegraph.git && cd sidegraph
 uv sync                        # runtime + dev dependencies (Python 3.13+)
 uv run pre-commit install      # once per clone — the lint gate runs before each commit
-uv run pytest -q               # full suite must be green
-uv run pre-commit run --all-files   # lint + format + types, exactly what CI runs
+uv run pytest tests/test_store.py -q -x --lf   # while editing: the touched file
+uv run pytest -m "not slow"   # broader pre-push check: skips subprocess-heavy tests, still takes minutes
+uv run pytest -q               # full suite: run before a commit or PR, must be green; CI runs it again
+uv run pre-commit run --all-files   # lint + format + types + staged secrets
 ```
 
+
+The Gitleaks commit hook scans staged content even when all changed paths are excluded from
+formatting, including `.sidegraph/`. `--all-files` does not turn it into a committed scan.
+CI additionally scans all history reachable from HEAD with the same pinned scanner:
+
+```bash
+uv run pre-commit run gitleaks-history --hook-stage manual --all-files
+SIDEGRAPH_SECRET_SCAN_INTEGRATION=1 uv run pytest tests/test_secret_scan_gate.py -q
+```
+
+The history scanner includes merge changes and traverses every commit reachable from HEAD.
+Use a full checkout; CI rejects shallow history before scanning.
+
+The second command runs real scanner integration tests; they are skipped in ordinary Python
+test runs to avoid implicit scanner installation. The opt-in is read at collection time.
+Findings are redacted. The history command needs a full Git checkout to cover earlier commits.
+
+A passing test's `tmp_path` tree is removed; a failing test's is kept for inspection
+(`tmp_path_retention_policy = "failed"` in `pyproject.toml`). Run with
+`-o tmp_path_retention_policy=all` to keep every test's tree.
+
 The suite is hermetic to `SIDEGRAPH_*` environment variables: `tests/conftest.py` strips every
 one of them before each test runs, so a variable already set in your shell can never change what
 the suite asserts. A test that needs one set must set it explicitly with `monkeypatch` rather

{sidegraph-0.10.0 → sidegraph-0.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sidegraph
-Version: 0.10.0
+Version: 0.11.1
 Summary: Own the memory, rent the graph — a durable decision/lessons layer as a sidecar over a code-graph engine.
 Project-URL: Homepage, https://github.com/SantyagoSeaman/sidegraph
 Project-URL: Repository, https://github.com/SantyagoSeaman/sidegraph
@@ -253,17 +253,18 @@ retrieval a richer graph to anchor against. Walkthrough:
 
 - **Everything is local.** Sidegraph reads your repo and the engine's `graph.json`
   (strictly read-only) and writes small human-readable JSON records inside your repo,
-  plus a local, gitignored index it can always rebuild. Two things sit outside the store:
-  the git hooks that `sidegraph-init` can install to keep the graph fresh (a helper and
-  three hooks under `.git/hooks/`) and one cache file, `sidegraph/launch-commit`, under
-  `${XDG_CACHE_HOME:-~/.cache}`. [SECURITY.md](SECURITY.md) lists every write.
+  plus a local, gitignored index it can always rebuild. Commands can also write graph-refresh
+  hooks and their helper files, repository configuration, reports and visualization output;
+  the plugin launch hook can write a cache file under `${XDG_CACHE_HOME:-~/.cache}`.
+  [SECURITY.md](SECURITY.md) lists every write.
   **Nothing leaves your machine** —
   no network calls, no remote telemetry, no account. Sidegraph does keep local usage
   diagnostics in that gitignored index (which stored memory was shown, and which files a
   session touched afterwards) so you can see which memory was shown and which files
   those sessions then touched; they never travel, and `SIDEGRAPH_TELEMETRY=off` disables them.
-- **Secrets don't enter memory.** Proposed decisions and facts pass redaction before they
-  are stored. A ratification gate controls which of the agent's drafts become trusted
+- **Captured text is redacted before storage.** Redaction is best-effort pattern matching;
+  review drafts and scan the committed store for secrets. Proposed decisions and facts pass
+  this redaction step before they are stored. A ratification gate controls which of the agent's drafts become trusted
   memory. Under the default `manual` policy a person ratifies them. A proposal is stored first
   and waits as `proposed` until then. If you answer yes to `sidegraph-init`'s
   question (or set `SIDEGRAPH_RATIFY_POLICY` yourself), eligible records ratify themselves

{sidegraph-0.10.0 → sidegraph-0.11.1}/README.md

@@ -223,17 +223,18 @@ retrieval a richer graph to anchor against. Walkthrough:
 
 - **Everything is local.** Sidegraph reads your repo and the engine's `graph.json`
   (strictly read-only) and writes small human-readable JSON records inside your repo,
-  plus a local, gitignored index it can always rebuild. Two things sit outside the store:
-  the git hooks that `sidegraph-init` can install to keep the graph fresh (a helper and
-  three hooks under `.git/hooks/`) and one cache file, `sidegraph/launch-commit`, under
-  `${XDG_CACHE_HOME:-~/.cache}`. [SECURITY.md](SECURITY.md) lists every write.
+  plus a local, gitignored index it can always rebuild. Commands can also write graph-refresh
+  hooks and their helper files, repository configuration, reports and visualization output;
+  the plugin launch hook can write a cache file under `${XDG_CACHE_HOME:-~/.cache}`.
+  [SECURITY.md](SECURITY.md) lists every write.
   **Nothing leaves your machine** —
   no network calls, no remote telemetry, no account. Sidegraph does keep local usage
   diagnostics in that gitignored index (which stored memory was shown, and which files a
   session touched afterwards) so you can see which memory was shown and which files
   those sessions then touched; they never travel, and `SIDEGRAPH_TELEMETRY=off` disables them.
-- **Secrets don't enter memory.** Proposed decisions and facts pass redaction before they
-  are stored. A ratification gate controls which of the agent's drafts become trusted
+- **Captured text is redacted before storage.** Redaction is best-effort pattern matching;
+  review drafts and scan the committed store for secrets. Proposed decisions and facts pass
+  this redaction step before they are stored. A ratification gate controls which of the agent's drafts become trusted
   memory. Under the default `manual` policy a person ratifies them. A proposal is stored first
   and waits as `proposed` until then. If you answer yes to `sidegraph-init`'s
   question (or set `SIDEGRAPH_RATIFY_POLICY` yourself), eligible records ratify themselves