zettelforge 2.3.0__tar.gz → 2.4.0__tar.gz

{zettelforge-2.3.0 → zettelforge-2.4.0}/CHANGELOG.md

@@ -6,6 +6,61 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-04-19
+
+Detection-rules-as-memory, MCP Registry publication, SQLite concurrency
+hardening, and a full test-suite hygiene pass.
+
+### Added
+
+- **Detection rules as first-class memory** (#70) — Sigma and YARA rules
+  are now ingested, indexed, and retrieved alongside CTI entities, with
+  an LLM rule explainer that surfaces what each rule detects and the
+  actors/techniques it's associated with. See the "Detection Rules as
+  Memory" section in the README (#74) for usage.
+- **MCP Registry publication** (#75) — `server.json` and the `mcp-name`
+  tag required to publish ZettelForge to the canonical MCP Registry
+  (registry.modelcontextprotocol.io), which feeds mcp.so and the
+  modelcontextprotocol.io community-servers list.
+- **Brand & docs polish** (#61) — neural-chain architecture diagram with
+  light/dark parity, updated GitHub social preview, canonical security
+  channels + RFC 9116 `security.txt`, real Code of Conduct contacts,
+  and a complete brand documentation set.
+
+### Fixed
+
+- **SQLite backend concurrency** (#69) — 16 reader methods in
+  `SQLiteBackend` (`get_note_by_id`, `get_note_by_source_ref`,
+  `iterate_notes`, `get_notes_by_domain`, `get_recent_notes`,
+  `count_notes`, `get_kg_node`, `get_kg_node_by_id`,
+  `get_kg_neighbors`, `traverse_kg`, `get_entity_timeline`,
+  `get_changes_since`, `get_causal_edges`, `get_incoming_causal`,
+  `get_note_ids_for_entity`, `search_entities`) were executing
+  `SELECT` statements without holding `_write_lock`, while writers
+  acquired it. Under concurrent background enrichment, readers could
+  observe a partially-written row and raise `pydantic.ValidationError`
+  on NULL columns. Each reader now wraps its SQL execute+fetch block
+  in `with self._write_lock:` (RLock, reentrant-safe). Closes #68.
+  Eliminates the `test_apply_delete_marks_superseded` flake and
+  prevents the same race from surfacing in production
+  `recall()`-during-write paths.
+- **CI regressions** (#67) — stabilized three tests exposed by the
+  test-suite audit sprint.
+
+### Changed
+
+- **Test suite hygiene** (#62, #63, #64, #65) — post-v2.3.0 audit (see
+  `docs/superpowers/research/2026-04-17-test-suite-audit.md`)
+  converted 10 CI-skipped LLM tests to the mock provider (RFC-002
+  Phase 1), resolved both remaining `xfail` tests via prompt-routed
+  mocks, eliminated two long-standing flakes
+  (`test_recall_cve_returns_notes`, `test_apply_delete_marks_superseded`),
+  prepped `langchain_retriever` for Pydantic V3 by migrating to
+  `ConfigDict`, and reinstated meaningful causal-edge validation via
+  mock-seeded triples + `SQLiteBackend.get_causal_edges` query. Net
+  test-suite delta: 280 passed / 17 skipped / 2 xfailed → 305 passed
+  / 10 skipped / 0 xfailed on test-3.12.
+
 ## [2.3.0] - 2026-04-17
 
 Pluggable LLM provider infrastructure (RFC-002 Phase 1), MCP server

{zettelforge-2.3.0 → zettelforge-2.4.0}/CODE_OF_CONDUCT.md

@@ -37,7 +37,7 @@ This Code of Conduct applies within all community spaces, and also applies when
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at [INSERT CONTACT METHOD]. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement by email at **conduct@threatrecall.ai**, or privately via GitHub's [report abuse](https://github.com/rolandpg/zettelforge/security/advisories/new) flow. All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

{zettelforge-2.3.0 → zettelforge-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zettelforge
-Version: 2.3.0
+Version: 2.4.0
 Summary: ZettelForge: Agentic Memory System with vector search, knowledge graph, and synthesis
 Project-URL: Homepage, https://github.com/rolandpg/zettelforge
 Project-URL: Documentation, https://docs.threatrecall.ai
@@ -25,10 +25,13 @@ Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.10
 Requires-Dist: fastembed>=0.8.0
 Requires-Dist: httpx>=0.25.0
+Requires-Dist: jsonschema>=4.0
 Requires-Dist: lancedb>=0.5.0
 Requires-Dist: numpy>=1.24.0
+Requires-Dist: plyara>=2.0
 Requires-Dist: pyarrow>=14.0.0
 Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyyaml>=6.0
 Requires-Dist: requests>=2.31.0
 Requires-Dist: structlog>=24.0.0
 Requires-Dist: tantivy>=0.11.0
@@ -52,6 +55,8 @@ Description-Content-Type: text/markdown
 
 # ZettelForge
 
+<!-- mcp-name: io.github.rolandpg/zettelforge -->
+
 **The only agentic memory system built for cyber threat intelligence.**
 
 Persistent memory for AI agents and Claude Code — with CTI entity extraction, STIX knowledge graphs, threat-actor alias resolution, and offline-first RAG. MCP server included. No cloud, no API keys.
@@ -95,7 +100,11 @@ ZettelForge was built from the ground up for analysts who think in threat graphs
 
 ## Data Pipeline
 <p align="center">
-  <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — Extract, Graph, Embed, Recall pipeline">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture-light.svg">
+    <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — neural recall loop: ingest, enrich, retrieve, synthesize, backed by SQLite + LanceDB">
+  </picture>
 </p>
 
 
@@ -208,6 +217,35 @@ Your Claude Code agent can now remember and recall threat intelligence across se
 
 Exposed tools: `remember`, `recall`, `synthesize`, `entity`, `graph`, `stats`.
 
+## Detection Rules as Memory (Sigma + YARA)
+
+Sigma and YARA rules are first-class memory primitives. Parse, validate, and ingest a rule and its tags become graph edges: MITRE ATT&CK techniques, CVEs, threat-actor aliases, tools, and malware families resolve against the same ontology as every other note. A shared `DetectionRule` supertype carries `SigmaRule` and `YaraRule` subtypes, so a single rule UUID is addressable across both formats.
+
+Sigma rules are validated against the vendored [SigmaHQ JSON schema](https://github.com/SigmaHQ/sigma-specification). YARA rules are parsed with plyara and validated against the [CCCS YARA metadata standard](https://github.com/CybercentreCanada/CCCS-Yara) (tiers: `strict`, `warn`, `non_cccs`). Ingest is idempotent -- re-ingesting an unchanged rule returns the original note via a content-hashed `source_ref`.
+
+```python
+from zettelforge import MemoryManager
+from zettelforge.sigma import ingest_rule as ingest_sigma
+from zettelforge.yara import ingest_rule as ingest_yara
+
+mm = MemoryManager()
+ingest_sigma("rules/proc_creation_win_office_macro.yml", mm)
+ingest_yara("rules/webshell_china_chopper.yar", mm, tier="warn")
+```
+
+```bash
+# Bulk ingest from SigmaHQ or a private rule repo
+python -m zettelforge.sigma.ingest /path/to/sigma/rules/
+python -m zettelforge.yara.ingest /path/to/yara/rules/ --tier warn
+
+# CI fixture check -- parse + validate, no writes
+python -m zettelforge.sigma.ingest rules/ --dry-run
+```
+
+An LLM rule explainer (`zettelforge.detection.explainer.explain`) produces a structured JSON summary -- intent, key fields, evasion notes, false-positive hypotheses -- for any `DetectionRule`. It runs synchronously on demand in v1; async enrichment-queue wiring is v1.1. Rate-limited via `ZETTELFORGE_EXPLAIN_RPM` (default 60 calls/minute).
+
+References: [Sigma spec](https://github.com/SigmaHQ/sigma-specification), [SigmaHQ rules](https://github.com/SigmaHQ/sigma), [CCCS YARA](https://github.com/CybercentreCanada/CCCS-Yara), [YARA docs](https://yara.readthedocs.io).
+
 ## Integrations
 
 ### ATHF (Agentic Threat Hunting Framework)

{zettelforge-2.3.0 → zettelforge-2.4.0}/README.md

@@ -1,5 +1,7 @@
 # ZettelForge
 
+<!-- mcp-name: io.github.rolandpg/zettelforge -->
+
 **The only agentic memory system built for cyber threat intelligence.**
 
 Persistent memory for AI agents and Claude Code — with CTI entity extraction, STIX knowledge graphs, threat-actor alias resolution, and offline-first RAG. MCP server included. No cloud, no API keys.
@@ -43,7 +45,11 @@ ZettelForge was built from the ground up for analysts who think in threat graphs
 
 ## Data Pipeline
 <p align="center">
-  <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — Extract, Graph, Embed, Recall pipeline">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture-light.svg">
+    <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — neural recall loop: ingest, enrich, retrieve, synthesize, backed by SQLite + LanceDB">
+  </picture>
 </p>
 
 
@@ -156,6 +162,35 @@ Your Claude Code agent can now remember and recall threat intelligence across se
 
 Exposed tools: `remember`, `recall`, `synthesize`, `entity`, `graph`, `stats`.
 
+## Detection Rules as Memory (Sigma + YARA)
+
+Sigma and YARA rules are first-class memory primitives. Parse, validate, and ingest a rule and its tags become graph edges: MITRE ATT&CK techniques, CVEs, threat-actor aliases, tools, and malware families resolve against the same ontology as every other note. A shared `DetectionRule` supertype carries `SigmaRule` and `YaraRule` subtypes, so a single rule UUID is addressable across both formats.
+
+Sigma rules are validated against the vendored [SigmaHQ JSON schema](https://github.com/SigmaHQ/sigma-specification). YARA rules are parsed with plyara and validated against the [CCCS YARA metadata standard](https://github.com/CybercentreCanada/CCCS-Yara) (tiers: `strict`, `warn`, `non_cccs`). Ingest is idempotent -- re-ingesting an unchanged rule returns the original note via a content-hashed `source_ref`.
+
+```python
+from zettelforge import MemoryManager
+from zettelforge.sigma import ingest_rule as ingest_sigma
+from zettelforge.yara import ingest_rule as ingest_yara
+
+mm = MemoryManager()
+ingest_sigma("rules/proc_creation_win_office_macro.yml", mm)
+ingest_yara("rules/webshell_china_chopper.yar", mm, tier="warn")
+```
+
+```bash
+# Bulk ingest from SigmaHQ or a private rule repo
+python -m zettelforge.sigma.ingest /path/to/sigma/rules/
+python -m zettelforge.yara.ingest /path/to/yara/rules/ --tier warn
+
+# CI fixture check -- parse + validate, no writes
+python -m zettelforge.sigma.ingest rules/ --dry-run
+```
+
+An LLM rule explainer (`zettelforge.detection.explainer.explain`) produces a structured JSON summary -- intent, key fields, evasion notes, false-positive hypotheses -- for any `DetectionRule`. It runs synchronously on demand in v1; async enrichment-queue wiring is v1.1. Rate-limited via `ZETTELFORGE_EXPLAIN_RPM` (default 60 calls/minute).
+
+References: [Sigma spec](https://github.com/SigmaHQ/sigma-specification), [SigmaHQ rules](https://github.com/SigmaHQ/sigma), [CCCS YARA](https://github.com/CybercentreCanada/CCCS-Yara), [YARA docs](https://yara.readthedocs.io).
+
 ## Integrations
 
 ### ATHF (Agentic Threat Hunting Framework)

{zettelforge-2.3.0 → zettelforge-2.4.0}/SECURITY.md

@@ -1,5 +1,26 @@
 # Security Policy
 
+## Canonical Channels
+
+To avoid supply-chain and impersonation risk, only the following are
+official distribution channels for ZettelForge and ThreatRecall:
+
+| Artifact | Canonical URL |
+|---|---|
+| Source repository | https://github.com/rolandpg/zettelforge |
+| Python package | https://pypi.org/project/zettelforge/ |
+| Release artifacts | https://github.com/rolandpg/zettelforge/releases |
+| Documentation | https://docs.threatrecall.ai/ |
+| Official hosted service | https://threatrecall.ai/ |
+| Security disclosure | contact@threatrecall.ai (this file) |
+
+Packages installed from anywhere else — including any `zettelforge-*`
+typosquats, alternate PyPI mirrors, forks published under a different
+namespace, or third-party "ZettelForge Cloud" / "ThreatRecall" hosted
+services — are not affiliated with this project and have not been
+reviewed by the maintainers. Verify provenance via the signed release
+artifacts when in doubt.
+
 ## Reporting a Vulnerability
 
 **Do not open a public GitHub issue for security vulnerabilities.**
@@ -39,9 +60,9 @@ backported to the prior minor release.
 
 | Version | Supported |
 |---|---|
-| 2.3.x (current) | Yes — active security support |
-| 2.2.x | Critical fixes only, for 60 days after 2.3.0 release |
-| < 2.2 | No — upgrade required |
+| 2.4.x (current) | Yes — active security support |
+| 2.3.x | Critical fixes only, for 60 days after 2.4.0 release |
+| < 2.3 | No — upgrade required |
 
 ---
 

zettelforge-2.4.0/docs/.well-known/security.txt

@@ -0,0 +1,10 @@
+# ZettelForge / ThreatRecall security.txt
+# RFC 9116 — https://www.rfc-editor.org/rfc/rfc9116
+# Canonical source: https://github.com/rolandpg/zettelforge/blob/master/docs/.well-known/security.txt
+
+Contact: mailto:contact@threatrecall.ai
+Contact: https://github.com/rolandpg/zettelforge/security/advisories/new
+Expires: 2027-04-17T00:00:00Z
+Preferred-Languages: en
+Canonical: https://docs.threatrecall.ai/.well-known/security.txt
+Policy: https://github.com/rolandpg/zettelforge/blob/master/SECURITY.md

zettelforge-2.4.0/docs/assets/favicon.svg

@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 480">
+  
+  <defs>
+    <linearGradient id="fg" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#8ED1A0"></stop>
+      <stop offset="100%" stop-color="#5EAE78"></stop>
+    </linearGradient>
+  </defs>
+
+  
+  <path d="M55 35 H345 a16 16 0 0 1 16 16 V265 c0 96 -71 162 -161 196&#xA;           c-90 -34 -161 -100 -161 -196 V51 a16 16 0 0 1 16 -16 Z" fill="url(#fg)"></path>
+
+  
+  <path d="M200 178 C198 215 191 252 192 274 S199 338 200 358" fill="none" stroke="#fff" stroke-width="14" stroke-linecap="round" stroke-dasharray="8 34" opacity="0.45"></path>
+
+  
+  <circle cx="200" cy="172" r="38" fill="#fff"></circle>
+
+  
+  <path d="M128,96 C128,113 131,116 148,116 C131,116 128,119 128,136&#xA;           C128,119 125,116 108,116 C125,116 128,113 128,96 Z" fill="#fff"></path>
+  <path d="M272,96 C272,113 275,116 292,116 C275,116 272,119 272,136&#xA;           C272,119 269,116 252,116 C269,116 272,113 272,96 Z" fill="#fff"></path>
+  <path d="M200,64 C200,73 202,75 210,75 C202,75 200,77 200,86&#xA;           C200,77 198,75 190,75 C198,75 200,73 200,64 Z" fill="#fff"></path>
+  <circle cx="170" cy="88" r="9" fill="#fff"></circle>
+  <circle cx="230" cy="88" r="9" fill="#fff"></circle>
+
+  
+  <rect x="184" y="218" width="32" height="34" rx="10" fill="#fff"></rect>
+  <rect x="178" y="266" width="28" height="30" rx="9" fill="#fff"></rect>
+  <rect x="183" y="310" width="24" height="26" rx="7" fill="#fff"></rect>
+
+  
+  <path d="M200,346 L193,368 L172,363 L187,378 L172,393&#xA;           L193,388 L200,410 L207,388 L228,393 L213,378&#xA;           L228,363 L207,368 Z" fill="#fff"></path>
+</svg>

zettelforge-2.4.0/docs/assets/logo.svg

@@ -0,0 +1,46 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 480" role="img" aria-label="ThreatRecall">
+  <title>ThreatRecall</title>
+  <defs>
+    <linearGradient id="shieldGrad" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#8ED1A0"/>
+      <stop offset="100%" stop-color="#5EAE78"/>
+    </linearGradient>
+  </defs>
+
+  <!-- Shield -->
+  <path d="M55 35 H345 a16 16 0 0 1 16 16 V265 c0 96 -71 162 -161 196 c-90 -34 -161 -100 -161 -196 V51 a16 16 0 0 1 16 -16 Z"
+        fill="url(#shieldGrad)"/>
+
+  <!-- Axon recall trail (centered) -->
+  <path d="M200 158 C 198 205 190 250 192 275 S 199 345 200 365"
+        fill="none" stroke="#FFFFFF" stroke-width="2.5" stroke-linecap="round"
+        stroke-dasharray="1.5 7" opacity="0.5"/>
+
+  <!-- Cell body / nucleus -->
+  <circle cx="200" cy="155" r="24" fill="#FFFFFF"/>
+
+  <!-- Dendrites: symmetric sparkles -->
+  <path d="M 128,93 C 128,111.7 131.3,115 150,115 C 131.3,115 128,118.3 128,137 C 128,118.3 124.7,115 106,115 C 124.7,115 128,111.7 128,93 Z" fill="#FFFFFF"/>
+  <path d="M 272,93 C 272,111.7 275.3,115 294,115 C 275.3,115 272,118.3 272,137 C 272,118.3 268.7,115 250,115 C 268.7,115 272,111.7 272,93 Z" fill="#FFFFFF"/>
+  <path d="M 200,61 C 200,70.35 201.65,72 211,72 C 201.65,72 200,73.65 200,83 C 200,73.65 198.35,72 189,72 C 198.35,72 200,70.35 200,61 Z" fill="#FFFFFF"/>
+
+  <circle cx="168" cy="85" r="3.5" fill="#FFFFFF"/>
+  <circle cx="232" cy="85" r="3.5" fill="#FFFFFF"/>
+  <circle cx="112" cy="160" r="2.5" fill="#FFFFFF"/>
+  <circle cx="288" cy="160" r="2.5" fill="#FFFFFF"/>
+
+  <!-- Myelin segments on axon -->
+  <rect x="188" y="200" width="24" height="28" rx="8" fill="#FFFFFF"/>
+  <rect x="181" y="252" width="22" height="26" rx="7" fill="#FFFFFF"/>
+  <rect x="186" y="302" width="19" height="22" rx="6" fill="#FFFFFF"/>
+
+  <!-- Axon terminal burst -->
+  <path d="M 200.0,342.0 L 194.5,360.5 L 175.8,356.0 L 189.0,370.0 L 175.8,384.0 L 194.5,379.5 L 200.0,398.0 L 205.5,379.5 L 224.2,384.0 L 211.0,370.0 L 224.2,356.0 L 205.5,360.5 Z"
+        fill="#FFFFFF"/>
+
+  <!-- Axon terminal branches (symmetric) -->
+  <circle cx="155" cy="348" r="3" fill="#FFFFFF"/>
+  <circle cx="245" cy="348" r="3" fill="#FFFFFF"/>
+  <circle cx="160" cy="408" r="2.5" fill="#FFFFFF"/>
+  <circle cx="240" cy="408" r="2.5" fill="#FFFFFF"/>
+</svg>

zettelforge-2.4.0/docs/assets/threatrecall-lockup-monogram.svg

@@ -0,0 +1,41 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 320" role="img" aria-label="ThreatRecall">
+  <title>ThreatRecall monogram lockup</title>
+  <defs>
+    <linearGradient id="shieldGradMono" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#8ED1A0"/>
+      <stop offset="100%" stop-color="#5EAE78"/>
+    </linearGradient>
+  </defs>
+
+  <!-- Shield acts as capital T -->
+  <g transform="translate(30, 52) scale(0.4464)">
+    <path d="M55 35 H345 a16 16 0 0 1 16 16 V265 c0 96 -71 162 -161 196 c-90 -34 -161 -100 -161 -196 V51 a16 16 0 0 1 16 -16 Z" fill="url(#shieldGradMono)"/>
+    <path d="M200 158 C 198 205 190 250 192 275 S 199 345 200 365" fill="none" stroke="#FFFFFF" stroke-width="2.5" stroke-linecap="round" stroke-dasharray="1.5 7" opacity="0.5"/>
+    <circle cx="200" cy="155" r="24" fill="#FFFFFF"/>
+    <path d="M 128,93 C 128,111.7 131.3,115 150,115 C 131.3,115 128,118.3 128,137 C 128,118.3 124.7,115 106,115 C 124.7,115 128,111.7 128,93 Z" fill="#FFFFFF"/>
+    <path d="M 272,93 C 272,111.7 275.3,115 294,115 C 275.3,115 272,118.3 272,137 C 272,118.3 268.7,115 250,115 C 268.7,115 272,111.7 272,93 Z" fill="#FFFFFF"/>
+    <path d="M 200,61 C 200,70.35 201.65,72 211,72 C 201.65,72 200,73.65 200,83 C 200,73.65 198.35,72 189,72 C 198.35,72 200,70.35 200,61 Z" fill="#FFFFFF"/>
+    <circle cx="168" cy="85" r="3.5" fill="#FFFFFF"/>
+    <circle cx="232" cy="85" r="3.5" fill="#FFFFFF"/>
+    <circle cx="112" cy="160" r="2.5" fill="#FFFFFF"/>
+    <circle cx="288" cy="160" r="2.5" fill="#FFFFFF"/>
+    <rect x="188" y="200" width="24" height="28" rx="8" fill="#FFFFFF"/>
+    <rect x="181" y="252" width="22" height="26" rx="7" fill="#FFFFFF"/>
+    <rect x="186" y="302" width="19" height="22" rx="6" fill="#FFFFFF"/>
+    <path d="M 200.0,342.0 L 194.5,360.5 L 175.8,356.0 L 189.0,370.0 L 175.8,384.0 L 194.5,379.5 L 200.0,398.0 L 205.5,379.5 L 224.2,384.0 L 211.0,370.0 L 224.2,356.0 L 205.5,360.5 Z" fill="#FFFFFF"/>
+    <circle cx="155" cy="348" r="3" fill="#FFFFFF"/>
+    <circle cx="245" cy="348" r="3" fill="#FFFFFF"/>
+    <circle cx="160" cy="408" r="2.5" fill="#FFFFFF"/>
+    <circle cx="240" cy="408" r="2.5" fill="#FFFFFF"/>
+  </g>
+
+  <!-- Wordmark beginning at "h" since shield is the T -->
+  <g font-family="'Inter', 'Helvetica Neue', Arial, sans-serif">
+    <text x="210" y="200" font-size="130" font-weight="700" fill="#1F2937" letter-spacing="-4">
+      <tspan>hreat</tspan><tspan fill="#5EAE78" font-weight="800">Recall</tspan>
+    </text>
+    <text x="214" y="240" font-size="22" font-weight="500" fill="#6B7280" letter-spacing="4">
+      THREAT INTELLIGENCE . MEMORY . RECALL
+    </text>
+  </g>
+</svg>

zettelforge-2.4.0/docs/assets/threatrecall-lockup.svg

@@ -0,0 +1,39 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 320" role="img" aria-label="ThreatRecall">
+  <title>ThreatRecall lockup</title>
+  <defs>
+    <linearGradient id="shieldGrad2" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#8ED1A0"/>
+      <stop offset="100%" stop-color="#5EAE78"/>
+    </linearGradient>
+  </defs>
+
+  <g transform="translate(40, 20) scale(0.58)">
+    <path d="M55 35 H345 a16 16 0 0 1 16 16 V265 c0 96 -71 162 -161 196 c-90 -34 -161 -100 -161 -196 V51 a16 16 0 0 1 16 -16 Z" fill="url(#shieldGrad2)"/>
+    <path d="M200 158 C 198 205 190 250 192 275 S 199 345 200 365" fill="none" stroke="#FFFFFF" stroke-width="2.5" stroke-linecap="round" stroke-dasharray="1.5 7" opacity="0.5"/>
+    <circle cx="200" cy="155" r="24" fill="#FFFFFF"/>
+    <path d="M 128,93 C 128,111.7 131.3,115 150,115 C 131.3,115 128,118.3 128,137 C 128,118.3 124.7,115 106,115 C 124.7,115 128,111.7 128,93 Z" fill="#FFFFFF"/>
+    <path d="M 272,93 C 272,111.7 275.3,115 294,115 C 275.3,115 272,118.3 272,137 C 272,118.3 268.7,115 250,115 C 268.7,115 272,111.7 272,93 Z" fill="#FFFFFF"/>
+    <path d="M 200,61 C 200,70.35 201.65,72 211,72 C 201.65,72 200,73.65 200,83 C 200,73.65 198.35,72 189,72 C 198.35,72 200,70.35 200,61 Z" fill="#FFFFFF"/>
+    <circle cx="168" cy="85" r="3.5" fill="#FFFFFF"/>
+    <circle cx="232" cy="85" r="3.5" fill="#FFFFFF"/>
+    <circle cx="112" cy="160" r="2.5" fill="#FFFFFF"/>
+    <circle cx="288" cy="160" r="2.5" fill="#FFFFFF"/>
+    <rect x="188" y="200" width="24" height="28" rx="8" fill="#FFFFFF"/>
+    <rect x="181" y="252" width="22" height="26" rx="7" fill="#FFFFFF"/>
+    <rect x="186" y="302" width="19" height="22" rx="6" fill="#FFFFFF"/>
+    <path d="M 200.0,342.0 L 194.5,360.5 L 175.8,356.0 L 189.0,370.0 L 175.8,384.0 L 194.5,379.5 L 200.0,398.0 L 205.5,379.5 L 224.2,384.0 L 211.0,370.0 L 224.2,356.0 L 205.5,360.5 Z" fill="#FFFFFF"/>
+    <circle cx="155" cy="348" r="3" fill="#FFFFFF"/>
+    <circle cx="245" cy="348" r="3" fill="#FFFFFF"/>
+    <circle cx="160" cy="408" r="2.5" fill="#FFFFFF"/>
+    <circle cx="240" cy="408" r="2.5" fill="#FFFFFF"/>
+  </g>
+
+  <g font-family="'Inter', 'Helvetica Neue', Arial, sans-serif">
+    <text x="310" y="175" font-size="92" font-weight="700" fill="#1F2937" letter-spacing="-2">
+      <tspan>Threat</tspan><tspan fill="#5EAE78" font-weight="800">Recall</tspan>
+    </text>
+    <text x="313" y="215" font-size="22" font-weight="500" fill="#6B7280" letter-spacing="4">
+      THREAT INTELLIGENCE . MEMORY . RECALL
+    </text>
+  </g>
+</svg>

zettelforge-2.4.0/docs/assets/threatrecall-logo-flat.svg

@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 400 480" role="img" aria-label="ThreatRecall">
+  <title>ThreatRecall monochrome</title>
+
+  <path d="M55 35 H345 a16 16 0 0 1 16 16 V265 c0 96 -71 162 -161 196 c-90 -34 -161 -100 -161 -196 V51 a16 16 0 0 1 16 -16 Z"
+        fill="#6DB97F"/>
+
+  <circle cx="200" cy="155" r="24" fill="#FFFFFF"/>
+
+  <path d="M 128,93 C 128,111.7 131.3,115 150,115 C 131.3,115 128,118.3 128,137 C 128,118.3 124.7,115 106,115 C 124.7,115 128,111.7 128,93 Z" fill="#FFFFFF"/>
+  <path d="M 272,93 C 272,111.7 275.3,115 294,115 C 275.3,115 272,118.3 272,137 C 272,118.3 268.7,115 250,115 C 268.7,115 272,111.7 272,93 Z" fill="#FFFFFF"/>
+  <path d="M 200,61 C 200,70.35 201.65,72 211,72 C 201.65,72 200,73.65 200,83 C 200,73.65 198.35,72 189,72 C 198.35,72 200,70.35 200,61 Z" fill="#FFFFFF"/>
+
+  <circle cx="168" cy="85" r="3.5" fill="#FFFFFF"/>
+  <circle cx="232" cy="85" r="3.5" fill="#FFFFFF"/>
+  <circle cx="112" cy="160" r="2.5" fill="#FFFFFF"/>
+  <circle cx="288" cy="160" r="2.5" fill="#FFFFFF"/>
+
+  <rect x="188" y="200" width="24" height="28" rx="8" fill="#FFFFFF"/>
+  <rect x="181" y="252" width="22" height="26" rx="7" fill="#FFFFFF"/>
+  <rect x="186" y="302" width="19" height="22" rx="6" fill="#FFFFFF"/>
+
+  <path d="M 200.0,342.0 L 194.5,360.5 L 175.8,356.0 L 189.0,370.0 L 175.8,384.0 L 194.5,379.5 L 200.0,398.0 L 205.5,379.5 L 224.2,384.0 L 211.0,370.0 L 224.2,356.0 L 205.5,360.5 Z"
+        fill="#FFFFFF"/>
+
+  <circle cx="155" cy="348" r="3" fill="#FFFFFF"/>
+  <circle cx="245" cy="348" r="3" fill="#FFFFFF"/>
+  <circle cx="160" cy="408" r="2.5" fill="#FFFFFF"/>
+  <circle cx="240" cy="408" r="2.5" fill="#FFFFFF"/>
+</svg>

zettelforge-2.4.0/docs/assets/zettelforge_architecture-light.svg

@@ -0,0 +1,105 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 680 760" role="img" aria-labelledby="tt td">
+  <title id="tt">ZettelForge architecture</title>
+  <desc id="td">Four-stage CTI memory pipeline drawn as a neuron-chain: ingestion, enrichment, retrieval, synthesis, with pluggable storage and optional extensions.</desc>
+  <defs>
+    <filter id="pulse" x="-50%" y="-50%" width="200%" height="200%">
+      <feGaussianBlur stdDeviation="3" result="b"></feGaussianBlur>
+      <feMerge><feMergeNode in="b"></feMergeNode><feMergeNode in="SourceGraphic"></feMergeNode></feMerge>
+    </filter>
+  </defs>
+
+  <rect width="680" height="760" fill="#FFFFFF"></rect>
+
+  
+  <text x="40" y="42" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="11" font-weight="600" letter-spacing="0.08em" fill="#6B7280">ZETTELFORGE / ARCHITECTURE</text>
+  <text x="40" y="64" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="18" font-weight="600" letter-spacing="-0.01em" fill="#1F2937">Signal memory — a recall loop</text>
+  <text x="40" y="82" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="12" fill="#6B7280">Four-stage pipeline; each stage is a node, the axon is the dataflow.</text>
+  <line x1="40" y1="98" x2="640" y2="98" stroke="#E5E9F0"></line>
+
+  <text x="40" y="126" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="11" font-weight="600" letter-spacing="0.08em" fill="#6B7280">SOURCE</text>
+  <text x="40" y="144" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#1F2937">reports · alerts · notes · IOCs</text>
+
+  
+  <path d="M140 196 C 128 182 108 178 96 188" stroke="#C9D1D9" fill="none"></path>
+  <path d="M140 196 C 152 182 172 178 184 188" stroke="#C9D1D9" fill="none"></path>
+  <circle cx="96" cy="188" r="2" fill="#1F2937"></circle>
+  <circle cx="184" cy="188" r="2" fill="#1F2937"></circle>
+  <circle cx="140" cy="220" r="28" fill="#F4F6FA" stroke="#C9D1D9" stroke-width="1.25"></circle>
+  <circle cx="140" cy="220" r="6" fill="#1F2937"></circle>
+  <text x="140" y="252" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="10.5" font-weight="700" letter-spacing="0.12em" fill="#1F2937">01</text>
+  <rect x="196" y="192" width="444" height="72" rx="8" fill="#FFFFFF" stroke="#E5E9F0"></rect>
+  <text x="216" y="218" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="15" font-weight="600" letter-spacing="-0.01em" fill="#1F2937">Ingestion</text>
+  <text x="216" y="236" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">MemoryManager → FactExtractor</text>
+  <text x="216" y="254" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#1F2937">validate → extract entities → resolve aliases</text>
+  <text x="624" y="254" text-anchor="end" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">~45ms</text>
+  <path d="M140 252 L140 298" stroke="#C9D1D9" stroke-width="1.5" fill="none" stroke-dasharray="1.5 7" stroke-linecap="round"></path>
+
+  
+  <circle cx="140" cy="330" r="28" fill="#F4F6FA" stroke="#C9D1D9" stroke-width="1.25"></circle>
+  <circle cx="140" cy="330" r="6" fill="#1F2937"></circle>
+  <text x="140" y="362" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="10.5" font-weight="700" letter-spacing="0.12em" fill="#1F2937">02</text>
+  <rect x="196" y="302" width="444" height="72" rx="8" fill="#FFFFFF" stroke="#E5E9F0"></rect>
+  <text x="216" y="328" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="15" font-weight="600" letter-spacing="-0.01em" fill="#1F2937">Enrichment</text>
+  <text x="216" y="346" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">MemoryUpdater · background</text>
+  <text x="216" y="364" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#1F2937">causal triples · neighbor refinement · HGAM</text>
+  <path d="M140 358 L140 404" stroke="#C9D1D9" stroke-width="1.5" fill="none" stroke-dasharray="1.5 7" stroke-linecap="round"></path>
+
+  
+  <path d="M140 438 C 116 430 96 432 80 442" stroke="#5EAE78" stroke-width="1.25" fill="none" opacity="0.85"></path>
+  <path d="M140 438 C 164 430 184 432 200 442" stroke="#5EAE78" stroke-width="1.25" fill="none" opacity="0.85"></path>
+  <path d="M140 438 C 118 452 98 460 84 468" stroke="#5EAE78" stroke-width="1.25" fill="none" opacity="0.85"></path>
+  <path d="M140 438 C 162 452 182 460 196 468" stroke="#5EAE78" stroke-width="1.25" fill="none" opacity="0.85"></path>
+  <circle cx="80" cy="442" r="2.25" fill="#5EAE78" filter="url(#pulse)"></circle>
+  <circle cx="200" cy="442" r="2.25" fill="#5EAE78" filter="url(#pulse)"></circle>
+  <circle cx="84" cy="468" r="1.75" fill="#5EAE78"></circle>
+  <circle cx="196" cy="468" r="1.75" fill="#5EAE78"></circle>
+  <circle cx="140" cy="438" r="30" fill="#F4F6FA" stroke="#5EAE78" stroke-width="1.5" filter="url(#pulse)"></circle>
+  <circle cx="140" cy="438" r="6" fill="#5EAE78" filter="url(#pulse)"></circle>
+  <text x="140" y="472" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="10.5" font-weight="700" letter-spacing="0.12em" fill="#5EAE78">03</text>
+  <rect x="196" y="410" width="444" height="72" rx="8" fill="#FFFFFF" stroke="#5EAE78" stroke-width="1.25"></rect>
+  <text x="216" y="436" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="15" font-weight="600" letter-spacing="-0.01em" fill="#1F2937">Retrieval</text>
+  <text x="216" y="454" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">BlendedRetriever</text>
+  <text x="216" y="472" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#1F2937">intent · vector + graph BFS · temporal · rerank</text>
+  
+  <rect x="568" y="418" width="56" height="18" rx="9" fill="#5EAE78"></rect>
+  <circle cx="578" cy="427" r="2.25" fill="#FFFFFF"></circle>
+  <text x="596" y="431" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="10" font-weight="700" letter-spacing="0.14em" fill="#FFFFFF">LIVE</text>
+  <path d="M140 468 L140 514" stroke="#5EAE78" stroke-width="1.75" fill="none" stroke-dasharray="1.5 7" stroke-linecap="round"></path>
+
+  
+  <circle cx="140" cy="548" r="28" fill="#F4F6FA" stroke="#C9D1D9" stroke-width="1.25"></circle>
+  <circle cx="140" cy="548" r="6" fill="#1F2937"></circle>
+  <text x="140" y="580" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="10.5" font-weight="700" letter-spacing="0.12em" fill="#1F2937">04</text>
+  <line x1="140" y1="576" x2="140" y2="592" stroke="#C9D1D9"></line>
+  <line x1="130" y1="574" x2="122" y2="590" stroke="#C9D1D9"></line>
+  <line x1="150" y1="574" x2="158" y2="590" stroke="#C9D1D9"></line>
+  <rect x="196" y="520" width="444" height="72" rx="8" fill="#FFFFFF" stroke="#E5E9F0"></rect>
+  <text x="216" y="546" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="15" font-weight="600" letter-spacing="-0.01em" fill="#1F2937">Synthesis</text>
+  <text x="216" y="564" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">ContextInjector → RAG-as-answer</text>
+  <text x="216" y="582" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#1F2937">quality-validated · grounded to sources</text>
+  <text x="624" y="582" text-anchor="end" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">66.9% LOCOMO · +33%</text>
+
+  
+  <line x1="40" y1="626" x2="640" y2="626" stroke="#E5E9F0"></line>
+  <text x="40" y="648" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="11" font-weight="600" letter-spacing="0.08em" fill="#6B7280">PLUGGABLE STORAGE</text>
+  <text x="40" y="664" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#6B7280">StorageBackend ABC · 33 methods · ZETTELFORGE_BACKEND</text>
+
+  <rect x="40" y="676" width="292" height="48" rx="8" fill="#FFFFFF" stroke="#E5E9F0"></rect>
+  <text x="56" y="698" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="13.5" font-weight="600" fill="#1F2937">SQLite</text>
+  <text x="110" y="698" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">default</text>
+  <text x="56" y="714" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="12" fill="#6B7280">WAL · ACID · notes, graph, entities</text>
+
+  <rect x="348" y="676" width="292" height="48" rx="8" fill="#FFFFFF" stroke="#E5E9F0"></rect>
+  <text x="364" y="698" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="13.5" font-weight="600" fill="#1F2937">LanceDB</text>
+  <text x="422" y="698" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="11.5" font-weight="500" fill="#9CA3AF">vectors</text>
+  <text x="364" y="714" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="12" fill="#6B7280">768-dim · nomic-embed-text-v1.5-Q</text>
+
+  <text x="40" y="744" font-family="Inter, system-ui, -apple-system, &#39;Segoe UI&#39;, sans-serif" font-size="11" font-weight="600" letter-spacing="0.08em" fill="#6B7280">EXTENSIONS</text>
+  <g transform="translate(140, 732)">
+    <rect x="0" y="0" width="98" height="18" rx="9" fill="#F4F6FA" stroke="#E5E9F0"></rect><text x="49" y="12.5" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="12" font-weight="600" fill="#1F2937">TypeDB STIX 2.1</text>
+    <rect x="106" y="0" width="80" height="18" rx="9" fill="#F4F6FA" stroke="#E5E9F0"></rect><text x="146" y="12.5" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="12" font-weight="600" fill="#1F2937">OAuth/JWT</text>
+    <rect x="194" y="0" width="92" height="18" rx="9" fill="#F4F6FA" stroke="#E5E9F0"></rect><text x="240" y="12.5" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="12" font-weight="600" fill="#1F2937">OpenCTI sync</text>
+    <rect x="294" y="0" width="86" height="18" rx="9" fill="#F4F6FA" stroke="#E5E9F0"></rect><text x="337" y="12.5" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="12" font-weight="600" fill="#1F2937">Sigma rules</text>
+    <rect x="388" y="0" width="88" height="18" rx="9" fill="#F4F6FA" stroke="#E5E9F0"></rect><text x="432" y="12.5" text-anchor="middle" font-family="&#39;JetBrains Mono&#39;, ui-monospace, Menlo, Consolas, monospace" font-size="12" font-weight="600" fill="#1F2937">MCP server</text>
+  </g>
+</svg>