vault-graph 0.1.0__tar.gz

vault_graph-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,27 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Lint
+        run: uv run --python 3.12 ruff check src tests
+      - name: Type check
+        run: uv run --python 3.12 mypy src tests
+      - name: Test
+        run: uv run --python 3.12 pytest -q
+      - name: Build distributions
+        run: uv build
+      - name: Check distributions
+        run: uv run --python 3.12 --with twine python -m twine check dist/*

vault_graph-0.1.0/.github/workflows/publish-pypi.yml

@@ -0,0 +1,37 @@
+name: publish-pypi
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-pypi
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: github.repository == 'cutehackers/vault-graph'
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Lint
+        run: uv run --python 3.12 ruff check src tests
+      - name: Type check
+        run: uv run --python 3.12 mypy src tests
+      - name: Test
+        run: uv run --python 3.12 pytest -q
+      - name: Build distributions
+        run: uv build
+      - name: Check distributions
+        run: uv run --python 3.12 --with twine python -m twine check dist/*
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always

vault_graph-0.1.0/.github/workflows/publish-testpypi.yml

@@ -0,0 +1,35 @@
+name: publish-testpypi
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: publish-testpypi
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    if: github.repository == 'cutehackers/vault-graph'
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Lint
+        run: uv run --python 3.12 ruff check src tests
+      - name: Type check
+        run: uv run --python 3.12 mypy src tests
+      - name: Test
+        run: uv run --python 3.12 pytest -q
+      - name: Build distributions
+        run: uv build
+      - name: Check distributions
+        run: uv run --python 3.12 --with twine python -m twine check dist/*
+      - name: Publish to TestPyPI
+        run: uv publish --publish-url https://test.pypi.org/legacy/ --trusted-publishing always

vault_graph-0.1.0/.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.py[cod]
+
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.venv/
+.vault-graph/

vault_graph-0.1.0/AGENTS.md

@@ -0,0 +1,138 @@
+# AGENTS.md
+
+## Project Boundary
+
+Vault Graph is a read-only, rebuildable access layer over Vault. Do not make
+Vault Graph a durable knowledge source, and do not add behavior that edits,
+renames, rewrites, or deletes Vault content.
+
+## Source Documents
+
+- Read `docs/SPEC.md` before changing architecture, indexing, retrieval, graph,
+  or context-pack behavior.
+- Follow `docs/CONVENTIONS.md` for Python style and naming.
+
+## Documentation Operation Rules
+
+Use these rules when writing specs, implementation plans, or prompt templates.
+
+- Keep prompt templates compact. Move repeatable repository policy here instead
+  of duplicating it inside every goal prompt.
+- `docs/PATCH_LOG.md` records corrections made after review or verification.
+  Use it only when a plan, spec, or implementation is changed because a mismatch,
+  defect, or risk was found.
+- New patch entries must match the existing project style:
+  `## YYYY-MM-DD - <Short Title>`, then `**Trigger:**`, `**Scope:**`,
+  `**Core Values Protected:**`, `**Changes Applied:**`, and
+  `**Verification:**`.
+- `docs/DECISIONS.md` records accepted product, architecture, and policy
+  decisions only. Do not add pending decisions there.
+- If a decision needs user judgment, keep it in the active plan under
+  `Open Decisions` with context, options, trade-offs, and a recommendation.
+  Move it to `docs/DECISIONS.md` only after approval, using the existing
+  `Question`, `Decision`, `Reason`, and `Implications` style.
+- For both logs, be short, specific, and evidence-linked. Do not copy long
+  implementation-plan content into them.
+
+## 🤖 Software Engineering Philosophy
+
+> **Core Principle:**
+> "Always prioritize **'Deep Modules'**, **'Less Complexity'**, and **'Changeability'** over quick implementations."
+
+### 1. Complexity & Changeability
+
+- **Definition of Complexity:** Anything in the software structure that makes it hard to understand or modify.
+- **The Goal:** Maintain a codebase where changes are easy and predictable. A good codebase is one that rewards future development rather than punishing it.
+- **Anti-Entropy:** Actively resist "Software Entropy." Do not just add code; improve the design with every change. If a task increases entropy, **refactor first**, then implement.
+
+### 2. Deep Modules vs. Shallow Modules
+
+- **Deep Modules (Preferred):** High functionality hidden behind a simple, stable interface. These modules encapsulate complexity and reduce the cognitive load for both humans and AI.
+- **Shallow Modules (Avoid):** Small pieces of code with complex interfaces that expose internal logic. These lead to fragmented, fragile systems.
+- **Information Hiding:** Hide implementation details. The consumer of a module should never need to know _how_ it works, only _what_ it does.
+
+### 3. Strategic Programming
+
+- **Think Strategically:** Don't just solve the immediate problem (Tactical Programming). Design for the long-term health of the system.
+- **Shared Design Concept:** Before coding, ensure a shared understanding of the architecture. Reach a "shared mental model" through rigorous planning and questioning (e.g., "Grilling" process).
+- **Ubiquitous Language:** Use consistent terminology across documentation, design, and code to minimize communication gaps.
+
+### 4. Development Workflow & Safety
+
+- **Test-Driven Safety:** Use **TDD** and **Static Typing** (like Dart/Flutter) as a "speed limit." Never outrun your headlights; take small, verifiable steps.
+- **Interface-First:** Focus on designing robust interfaces. Delegate the tactical implementation to the AI while keeping it strictly within the defined boundaries.
+- **Modern Standards:** Always prioritize improved versions of methods and current industry standards over legacy or deprecated patterns.
+
+### 5. Human-AI Collaboration Role
+
+- **Human:** **Strategic Leader & Architect.** Focus on high-level design, module boundaries, and complexity management.
+- **AI:** **Tactical Programmer.** Execute implementation details, refactor according to the philosophy, and ensure code adheres to the strategic boundaries.
+
+## Coding Guidelines
+
+**Tradeoff:** These guidelines bias toward caution over speed. For trivial tasks, use judgment.
+
+### 1. Think Before Coding
+
+**Don't assume. Don't hide confusion. Surface tradeoffs.**
+
+Before implementing:
+
+- State your assumptions explicitly. If uncertain, ask.
+- If multiple interpretations exist, present them - don't pick silently.
+- If a simpler approach exists, say so. Push back when warranted.
+- If something is unclear, stop. Name what's confusing. Ask.
+
+### 2. Simplicity First
+
+**Minimum code that solves the problem. Nothing speculative.**
+
+- No features beyond what was asked.
+- No abstractions for single-use code.
+- No "flexibility" or "configurability" that wasn't requested.
+- No error handling for impossible scenarios.
+- If you write 200 lines and it could be 50, rewrite it.
+
+Ask yourself: "Would a senior engineer say this is overcomplicated?" If yes, simplify.
+
+### 3. Surgical Changes
+
+**Touch only what you must. Clean up only your own mess.**
+
+When editing existing code:
+
+- Don't "improve" adjacent code, comments, or formatting.
+- Don't refactor things that aren't broken.
+- Match existing style, even if you'd do it differently.
+- If you notice unrelated dead code, mention it - don't delete it.
+
+When your changes create orphans:
+
+- Remove imports/variables/functions that YOUR changes made unused.
+- Don't remove pre-existing dead code unless asked.
+
+The test: Every changed line should trace directly to the user's request.
+
+### 4. Goal-Driven Execution
+
+**Define success criteria. Loop until verified.**
+
+Transform tasks into verifiable goals:
+
+- "Add validation" → "Write tests for invalid inputs, then make them pass"
+- "Fix the bug" → "Write a test that reproduces it, then make it pass"
+- "Refactor X" → "Ensure tests pass before and after"
+
+For multi-step tasks, state a brief plan:
+
+```
+1. [Step] → verify: [check]
+2. [Step] → verify: [check]
+3. [Step] → verify: [check]
+```
+
+Strong success criteria let you loop independently. Weak criteria ("make it work") require constant clarification.
+
+---
+
+**These guidelines are working if:** fewer unnecessary changes in diffs, fewer rewrites due to overcomplication, and clarifying questions come before implementation rather than after mistakes.

vault_graph-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jun Hyoung Lee
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vault_graph-0.1.0/PKG-INFO

@@ -0,0 +1,222 @@
+Metadata-Version: 2.4
+Name: vault-graph
+Version: 0.1.0
+Summary: Read-only, rebuildable knowledge access layer over Vault.
+Project-URL: Homepage, https://github.com/cutehackers/vault-graph
+Project-URL: Repository, https://github.com/cutehackers/vault-graph
+Project-URL: Issues, https://github.com/cutehackers/vault-graph/issues
+Author: Jun Hyoung Lee
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Text Processing :: Indexing
+Requires-Python: >=3.12
+Requires-Dist: chromadb<2.0,>=1.5.9
+Requires-Dist: fastapi<1,>=0.115
+Requires-Dist: fastembed<1.0,>=0.8.0
+Requires-Dist: huggingface-hub<1.0,>=0.31
+Requires-Dist: mcp<2,>=1.27
+Requires-Dist: pyyaml>=6.0.2
+Requires-Dist: rustworkx<1.0,>=0.17
+Requires-Dist: typer>=0.12.5
+Requires-Dist: uvicorn<1,>=0.30
+Description-Content-Type: text/markdown
+
+# Vault Graph
+
+Status: Active local development
+
+Vault Graph is a read-only, rebuildable knowledge access layer over Vault.
+
+It helps humans and agents search Vault, trace decisions, inspect project
+memory, and build task-specific context packs without turning retrieval output
+into durable knowledge.
+
+Vault remains the source of truth. Vault Graph reads, indexes, retrieves, and
+explains Vault-derived context. It does not publish wiki pages, mutate raw
+sources, edit Vault documents, or replace Vault's validation workflow.
+
+## Install
+
+Prerequisites:
+
+- Python 3.12+
+- [`uv`](https://docs.astral.sh/uv/)
+
+Current source-checkout install:
+
+```bash
+git clone git@me.github.com:cutehackers/vault-graph.git
+cd vault-graph
+uv sync
+uv run --python 3.12 vg --help
+```
+
+Optional local command install from this checkout:
+
+```bash
+uv tool install -e .
+vg --help
+```
+
+PyPI registration is not required to use the current source checkout. It becomes
+necessary only when Vault Graph wants to promise this public install path:
+
+```bash
+uv tool install vault-graph
+```
+
+Do not advertise the PyPI command as the primary install path until the package
+has been published.
+
+## Quick Start
+
+Keep Vault Graph state outside your Vault:
+
+```bash
+vg init --vault /path/to/llm-wiki --state ~/.vault-graph
+vg index --state ~/.vault-graph
+vg status --state ~/.vault-graph
+vg search --state ~/.vault-graph "GraphRAG"
+vg context --state ~/.vault-graph "Implement GraphRAG MVP"
+```
+
+The first index builds local metadata, keyword, vector, and graph projections.
+Vault Graph uses local storage and local embeddings by default; it does not
+require hosted services for normal use.
+
+## Common Commands
+
+| Goal | Command |
+| --- | --- |
+| Register a Vault | `vg init --vault /path/to/llm-wiki --state ~/.vault-graph` |
+| Add another Vault | `vg vault add work --path /path/to/other-vault --state ~/.vault-graph` |
+| List Vaults | `vg vault list --state ~/.vault-graph` |
+| Index the active Vault | `vg index --state ~/.vault-graph` |
+| Index one Vault | `vg index --vault-id work --state ~/.vault-graph` |
+| Index all Vaults | `vg index --all-vaults --state ~/.vault-graph` |
+| Check health | `vg status --state ~/.vault-graph` |
+| Search evidence | `vg search --state ~/.vault-graph "query"` |
+| Include graph signals | `vg search --include-graph --state ~/.vault-graph "query"` |
+| Ask with evidence | `vg ask --state ~/.vault-graph "question"` |
+| Build a context pack | `vg context --state ~/.vault-graph "goal"` |
+| Find related items | `vg related --state ~/.vault-graph GraphRAG` |
+| Trace a decision | `vg decision-trace --state ~/.vault-graph GraphRAG` |
+
+Commands that accept `--vault-id` operate on one registered Vault. Commands that
+accept `--all-vaults` expand to all enabled registered Vaults. Commands without
+either option use the active Vault.
+
+## Connect An Agent Through MCP
+
+MCP server installation and MCP server registration are different things:
+
+- installation makes the `vg` command available
+- registration tells an agent how to start `vg serve --mcp`
+
+After indexing your Vault, register this stdio server in the agent's MCP config:
+
+```json
+{
+  "mcpServers": {
+    "vault-graph": {
+      "command": "uv",
+      "args": [
+        "run",
+        "--python",
+        "3.12",
+        "vg",
+        "serve",
+        "--mcp",
+        "--state",
+        "/path/to/.vault-graph"
+      ]
+    }
+  }
+}
+```
+
+The current Codex-style example lives at
+[`docs/superpowers/specs/phase-5/codex-local-stdio-config.example.json`](docs/superpowers/specs/phase-5/codex-local-stdio-config.example.json).
+
+Once connected, the agent can use these MCP tools:
+
+- `search_vault`
+- `build_context_pack`
+- `find_related`
+- `get_decision_trace`
+- `check_index_status`
+- `explain_result`
+- `summarize_project_memory`
+- `get_open_questions`
+- `get_recent_changes`
+- `ask_vault`
+
+Vault Graph provides evidence-first working context and evidence-first answers
+through `ask_vault` and `vg ask`.
+
+## Recommended Easy Setup
+
+The accepted onboarding target is a one-command setup flow:
+
+```bash
+vg setup --vault /path/to/llm-wiki --agent codex
+```
+
+This command:
+
+- uses `~/.vault-graph` as the default state path when `--state` is omitted
+- registers the Vault path
+- runs indexing
+- prepares MCP registration for the selected agent
+- prints the MCP server command or writes it only to an explicit agent config path
+
+The lower-level MCP commands should remain available for explicit control:
+
+```bash
+vg mcp register --agent codex --state ~/.vault-graph --config-path /path/to/agent-config.json
+vg mcp config --agent codex --state ~/.vault-graph --print
+```
+
+These commands are implemented product features. Their implementation design
+lives at
+[`docs/superpowers/specs/2026-06-24-cli-todo-command-implementation-design.md`](docs/superpowers/specs/2026-06-24-cli-todo-command-implementation-design.md):
+
+```bash
+vg setup --vault /path/to/llm-wiki --agent codex
+vg mcp register --agent codex --state ~/.vault-graph --config-path /path/to/agent-config.json
+vg mcp config --agent codex --state ~/.vault-graph --print
+vg watch
+vg ask "question"
+vg serve --http
+```
+
+## Guarantees
+
+Vault Graph user-facing features preserve these guarantees:
+
+- read-only access to Vault
+- local-first operation without mandatory hosted services
+- evidence-first retrieval, context packs, and answers
+- clear separation between stated facts and inferred links
+- warnings for stale, missing, contested, or deprecated material
+- reproducible indexes that can be deleted and rebuilt from Vault
+- Vault-scoped identity for multiple registered Vault roots
+- visible backend health and index freshness status
+- durable knowledge publication only through Vault
+
+## More Documentation
+
+- [`docs/FEATURES.md`](docs/FEATURES.md): user-facing feature catalog
+- [`docs/SPEC.md`](docs/SPEC.md): product specification and architecture
+- [`docs/DESIGN.md`](docs/DESIGN.md): design goals and boundaries
+- [`docs/PUBLISHING.md`](docs/PUBLISHING.md): PyPI release workflow and permissions
+
+## License
+
+Vault Graph is distributed under the MIT License. See [`LICENSE`](LICENSE).

vault_graph-0.1.0/README.md

@@ -0,0 +1,193 @@
+# Vault Graph
+
+Status: Active local development
+
+Vault Graph is a read-only, rebuildable knowledge access layer over Vault.
+
+It helps humans and agents search Vault, trace decisions, inspect project
+memory, and build task-specific context packs without turning retrieval output
+into durable knowledge.
+
+Vault remains the source of truth. Vault Graph reads, indexes, retrieves, and
+explains Vault-derived context. It does not publish wiki pages, mutate raw
+sources, edit Vault documents, or replace Vault's validation workflow.
+
+## Install
+
+Prerequisites:
+
+- Python 3.12+
+- [`uv`](https://docs.astral.sh/uv/)
+
+Current source-checkout install:
+
+```bash
+git clone git@me.github.com:cutehackers/vault-graph.git
+cd vault-graph
+uv sync
+uv run --python 3.12 vg --help
+```
+
+Optional local command install from this checkout:
+
+```bash
+uv tool install -e .
+vg --help
+```
+
+PyPI registration is not required to use the current source checkout. It becomes
+necessary only when Vault Graph wants to promise this public install path:
+
+```bash
+uv tool install vault-graph
+```
+
+Do not advertise the PyPI command as the primary install path until the package
+has been published.
+
+## Quick Start
+
+Keep Vault Graph state outside your Vault:
+
+```bash
+vg init --vault /path/to/llm-wiki --state ~/.vault-graph
+vg index --state ~/.vault-graph
+vg status --state ~/.vault-graph
+vg search --state ~/.vault-graph "GraphRAG"
+vg context --state ~/.vault-graph "Implement GraphRAG MVP"
+```
+
+The first index builds local metadata, keyword, vector, and graph projections.
+Vault Graph uses local storage and local embeddings by default; it does not
+require hosted services for normal use.
+
+## Common Commands
+
+| Goal | Command |
+| --- | --- |
+| Register a Vault | `vg init --vault /path/to/llm-wiki --state ~/.vault-graph` |
+| Add another Vault | `vg vault add work --path /path/to/other-vault --state ~/.vault-graph` |
+| List Vaults | `vg vault list --state ~/.vault-graph` |
+| Index the active Vault | `vg index --state ~/.vault-graph` |
+| Index one Vault | `vg index --vault-id work --state ~/.vault-graph` |
+| Index all Vaults | `vg index --all-vaults --state ~/.vault-graph` |
+| Check health | `vg status --state ~/.vault-graph` |
+| Search evidence | `vg search --state ~/.vault-graph "query"` |
+| Include graph signals | `vg search --include-graph --state ~/.vault-graph "query"` |
+| Ask with evidence | `vg ask --state ~/.vault-graph "question"` |
+| Build a context pack | `vg context --state ~/.vault-graph "goal"` |
+| Find related items | `vg related --state ~/.vault-graph GraphRAG` |
+| Trace a decision | `vg decision-trace --state ~/.vault-graph GraphRAG` |
+
+Commands that accept `--vault-id` operate on one registered Vault. Commands that
+accept `--all-vaults` expand to all enabled registered Vaults. Commands without
+either option use the active Vault.
+
+## Connect An Agent Through MCP
+
+MCP server installation and MCP server registration are different things:
+
+- installation makes the `vg` command available
+- registration tells an agent how to start `vg serve --mcp`
+
+After indexing your Vault, register this stdio server in the agent's MCP config:
+
+```json
+{
+  "mcpServers": {
+    "vault-graph": {
+      "command": "uv",
+      "args": [
+        "run",
+        "--python",
+        "3.12",
+        "vg",
+        "serve",
+        "--mcp",
+        "--state",
+        "/path/to/.vault-graph"
+      ]
+    }
+  }
+}
+```
+
+The current Codex-style example lives at
+[`docs/superpowers/specs/phase-5/codex-local-stdio-config.example.json`](docs/superpowers/specs/phase-5/codex-local-stdio-config.example.json).
+
+Once connected, the agent can use these MCP tools:
+
+- `search_vault`
+- `build_context_pack`
+- `find_related`
+- `get_decision_trace`
+- `check_index_status`
+- `explain_result`
+- `summarize_project_memory`
+- `get_open_questions`
+- `get_recent_changes`
+- `ask_vault`
+
+Vault Graph provides evidence-first working context and evidence-first answers
+through `ask_vault` and `vg ask`.
+
+## Recommended Easy Setup
+
+The accepted onboarding target is a one-command setup flow:
+
+```bash
+vg setup --vault /path/to/llm-wiki --agent codex
+```
+
+This command:
+
+- uses `~/.vault-graph` as the default state path when `--state` is omitted
+- registers the Vault path
+- runs indexing
+- prepares MCP registration for the selected agent
+- prints the MCP server command or writes it only to an explicit agent config path
+
+The lower-level MCP commands should remain available for explicit control:
+
+```bash
+vg mcp register --agent codex --state ~/.vault-graph --config-path /path/to/agent-config.json
+vg mcp config --agent codex --state ~/.vault-graph --print
+```
+
+These commands are implemented product features. Their implementation design
+lives at
+[`docs/superpowers/specs/2026-06-24-cli-todo-command-implementation-design.md`](docs/superpowers/specs/2026-06-24-cli-todo-command-implementation-design.md):
+
+```bash
+vg setup --vault /path/to/llm-wiki --agent codex
+vg mcp register --agent codex --state ~/.vault-graph --config-path /path/to/agent-config.json
+vg mcp config --agent codex --state ~/.vault-graph --print
+vg watch
+vg ask "question"
+vg serve --http
+```
+
+## Guarantees
+
+Vault Graph user-facing features preserve these guarantees:
+
+- read-only access to Vault
+- local-first operation without mandatory hosted services
+- evidence-first retrieval, context packs, and answers
+- clear separation between stated facts and inferred links
+- warnings for stale, missing, contested, or deprecated material
+- reproducible indexes that can be deleted and rebuilt from Vault
+- Vault-scoped identity for multiple registered Vault roots
+- visible backend health and index freshness status
+- durable knowledge publication only through Vault
+
+## More Documentation
+
+- [`docs/FEATURES.md`](docs/FEATURES.md): user-facing feature catalog
+- [`docs/SPEC.md`](docs/SPEC.md): product specification and architecture
+- [`docs/DESIGN.md`](docs/DESIGN.md): design goals and boundaries
+- [`docs/PUBLISHING.md`](docs/PUBLISHING.md): PyPI release workflow and permissions
+
+## License
+
+Vault Graph is distributed under the MIT License. See [`LICENSE`](LICENSE).