zettelforge 2.3.0__tar.gz → 2.4.1__tar.gz

{zettelforge-2.3.0 → zettelforge-2.4.1}/CHANGELOG.md

@@ -6,6 +6,146 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.4.1] - 2026-04-24
+
+Operational telemetry (RFC-007), TypeDB authentication hardening, and a
+tranche of SQLite backend correctness fixes surfaced by the sqlite
+review in issue #83.
+
+### Added
+
+- **Operational telemetry** (RFC-007, #85) — per-query recall /
+  synthesis metrics captured to `~/.amem/telemetry/telemetry_YYYY-MM-DD.jsonl`
+  when `ZETTELFORGE_LOG_LEVEL=DEBUG`. Five shipped components:
+  - `TelemetryCollector` class (`start_query` / `log_recall` /
+    `log_synthesis` / `log_feedback` / `auto_feedback_from_synthesis`)
+    with INFO/DEBUG-gated field sets, 1-hour TTL on in-memory query
+    context, and thread-safe JSONL append.
+  - `MemoryManager` integration — `recall()` and `synthesize()` gain a
+    non-breaking `actor=` kwarg; OCSF events extended via the
+    sanctioned `unmapped` object with a `zf_` prefix (class_uid 6002
+    compliant). `recall()` wraps `retriever.retrieve()` and
+    `graph_retriever.retrieve_note_ids()` with narrow-scope
+    `perf_counter` deltas for `vector_latency_ms` / `graph_latency_ms`.
+  - Daily aggregator (`python -m zettelforge.scripts.telemetry_aggregator`)
+    emitting a `DailyMetrics` JSON report (latency averages, tier
+    distribution, unused-notes count, top-utility notes).
+  - Human-evaluation workflow — 6-question rubric (`docs/human-evaluation-rubric.md`),
+    sampler script (`python -m zettelforge.scripts.human_eval_sampler`)
+    that selects 20 random briefings as a fill-in Markdown template,
+    and a `--write-events` path to append `event_type: "human_eval"`
+    entries back to telemetry.
+  - Optional Streamlit dashboard (`streamlit run
+    src/zettelforge/scripts/telemetry_dashboard.py`) — query volume,
+    latency p50/p95/max, tier distribution, utility trend,
+    unused-notes warning.
+  - Privacy contract: raw note content never persisted (IDs / tiers /
+    source_types / domains only); query text truncated at 200 chars
+    INFO / 500 chars DEBUG; local-only, no network calls.
+
+### Fixed
+
+- **SQLite shutdown NPE** (#84, issue #83 H3) — `close()` and
+  `initialize()` are now lock-protected and idempotent. Readers and
+  writers raise a clean `BackendClosedError` (new, in
+  `storage_backend`) instead of the opaque `AttributeError: 'NoneType'
+  object has no attribute 'execute'` seen 170× in production logs on
+  2026-04-23 during atexit. `memory_manager._enrichment_loop` and
+  `_drain_enrichment_queue` catch `BackendClosedError` and exit
+  cleanly.
+- **SQLite torn snapshot** (#84, issue #83 C1) — `export_snapshot()`
+  now uses `sqlite3.Connection.backup()` for a page-consistent copy.
+  The previous `shutil.copy2` path could produce a corrupt backup
+  missing `-wal` / `-shm` sidecars, unsafe for DR restore.
+- **SQLite reindex race** (#84, issue #83 C2) — `reindex_vector()` now
+  uses a single-lock targeted `UPDATE` on the `embedding_vector`
+  column. The previous `get_note_by_id → rewrite_note` path spanned
+  two lock acquisitions and could clobber concurrent
+  `mark_access_dirty` / `evolve` / supersede edits via
+  `INSERT OR REPLACE`.
+
+### Security
+
+- **TypeDB authentication hardening** (#82) — removed known-insecure
+  `admin` / `password` defaults from `TypeDBConfig` and
+  `config.default.yaml`. `TypeDBConfig.__repr__` now redacts
+  non-empty passwords as `***`. The config loader resolves
+  `${TYPEDB_USERNAME}` / `${TYPEDB_PASSWORD}` env-var references in
+  YAML (same pattern already used for `llm.api_key`), so secrets can
+  stay in env / container secret stores rather than on disk.
+  Migration: set `TYPEDB_USERNAME` / `TYPEDB_PASSWORD` in your
+  environment or use the `${VAR}` references in a local
+  `config.yaml`. Direct env overrides (`TYPEDB_USERNAME=…`) already
+  worked and are unaffected.
+
+### Docs
+
+- **Architecture Deep Dive + Module Inventory for v2.4.0** (#80) —
+  reference-level architecture documentation.
+- **RFC-007 Operational Telemetry** (#85) — full design doc including
+  the four subagent-resolved frictions (caller-opt-in query_id
+  correlation, narrow-scope latency instrumentation, OCSF unmapped
+  extension, hybrid `__new__`-bypass integration tests).
+- **Human Evaluation Rubric** (#85) — 6-question monthly review
+  rubric with scoring summary table.
+- **Troubleshoot guide** (#85) — "Operational telemetry" subsection
+  covering the three CLI entry points and the privacy contract.
+
+## [2.4.0] - 2026-04-19
+
+Detection-rules-as-memory, MCP Registry publication, SQLite concurrency
+hardening, and a full test-suite hygiene pass.
+
+### Added
+
+- **Detection rules as first-class memory** (#70) — Sigma and YARA rules
+  are now ingested, indexed, and retrieved alongside CTI entities, with
+  an LLM rule explainer that surfaces what each rule detects and the
+  actors/techniques it's associated with. See the "Detection Rules as
+  Memory" section in the README (#74) for usage.
+- **MCP Registry publication** (#75) — `server.json` and the `mcp-name`
+  tag required to publish ZettelForge to the canonical MCP Registry
+  (registry.modelcontextprotocol.io), which feeds mcp.so and the
+  modelcontextprotocol.io community-servers list.
+- **Brand & docs polish** (#61) — neural-chain architecture diagram with
+  light/dark parity, updated GitHub social preview, canonical security
+  channels + RFC 9116 `security.txt`, real Code of Conduct contacts,
+  and a complete brand documentation set.
+
+### Fixed
+
+- **SQLite backend concurrency** (#69) — 16 reader methods in
+  `SQLiteBackend` (`get_note_by_id`, `get_note_by_source_ref`,
+  `iterate_notes`, `get_notes_by_domain`, `get_recent_notes`,
+  `count_notes`, `get_kg_node`, `get_kg_node_by_id`,
+  `get_kg_neighbors`, `traverse_kg`, `get_entity_timeline`,
+  `get_changes_since`, `get_causal_edges`, `get_incoming_causal`,
+  `get_note_ids_for_entity`, `search_entities`) were executing
+  `SELECT` statements without holding `_write_lock`, while writers
+  acquired it. Under concurrent background enrichment, readers could
+  observe a partially-written row and raise `pydantic.ValidationError`
+  on NULL columns. Each reader now wraps its SQL execute+fetch block
+  in `with self._write_lock:` (RLock, reentrant-safe). Closes #68.
+  Eliminates the `test_apply_delete_marks_superseded` flake and
+  prevents the same race from surfacing in production
+  `recall()`-during-write paths.
+- **CI regressions** (#67) — stabilized three tests exposed by the
+  test-suite audit sprint.
+
+### Changed
+
+- **Test suite hygiene** (#62, #63, #64, #65) — post-v2.3.0 audit (see
+  `docs/superpowers/research/2026-04-17-test-suite-audit.md`)
+  converted 10 CI-skipped LLM tests to the mock provider (RFC-002
+  Phase 1), resolved both remaining `xfail` tests via prompt-routed
+  mocks, eliminated two long-standing flakes
+  (`test_recall_cve_returns_notes`, `test_apply_delete_marks_superseded`),
+  prepped `langchain_retriever` for Pydantic V3 by migrating to
+  `ConfigDict`, and reinstated meaningful causal-edge validation via
+  mock-seeded triples + `SQLiteBackend.get_causal_edges` query. Net
+  test-suite delta: 280 passed / 17 skipped / 2 xfailed → 305 passed
+  / 10 skipped / 0 xfailed on test-3.12.
+
 ## [2.3.0] - 2026-04-17
 
 Pluggable LLM provider infrastructure (RFC-002 Phase 1), MCP server

{zettelforge-2.3.0 → zettelforge-2.4.1}/CODE_OF_CONDUCT.md

@@ -37,7 +37,7 @@ This Code of Conduct applies within all community spaces, and also applies when
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at [INSERT CONTACT METHOD]. All complaints will be reviewed and investigated promptly and fairly.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement by email at **conduct@threatrecall.ai**, or privately via GitHub's [report abuse](https://github.com/rolandpg/zettelforge/security/advisories/new) flow. All complaints will be reviewed and investigated promptly and fairly.
 
 All community leaders are obligated to respect the privacy and security of the reporter of any incident.
 

zettelforge-2.4.1/PKG-INFO

@@ -0,0 +1,324 @@
+Metadata-Version: 2.4
+Name: zettelforge
+Version: 2.4.1
+Summary: ZettelForge: Agentic Memory System with vector search, knowledge graph, and synthesis
+Project-URL: Homepage, https://github.com/rolandpg/zettelforge
+Project-URL: Documentation, https://docs.threatrecall.ai
+Project-URL: Repository, https://github.com/rolandpg/zettelforge
+Project-URL: Issues, https://github.com/rolandpg/zettelforge/issues
+Project-URL: Changelog, https://github.com/rolandpg/zettelforge/blob/master/CHANGELOG.md
+Author-email: Patrick Roland <patrick@groland.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agentic-memory,ai-agent,cti,cybersecurity,knowledge-graph,llm-memory,mcp-server,rag,stix,threat-intelligence
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Requires-Dist: fastembed>=0.8.0
+Requires-Dist: httpx>=0.25.0
+Requires-Dist: jsonschema>=4.0
+Requires-Dist: lancedb>=0.5.0
+Requires-Dist: numpy>=1.24.0
+Requires-Dist: plyara>=2.0
+Requires-Dist: pyarrow>=14.0.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: requests>=2.31.0
+Requires-Dist: structlog>=24.0.0
+Requires-Dist: tantivy>=0.11.0
+Provides-Extra: dev
+Requires-Dist: langchain-core>=0.2.0; extra == 'dev'
+Requires-Dist: mypy>=1.0.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
+Requires-Dist: pytest>=7.0.0; extra == 'dev'
+Requires-Dist: ruff>=0.4.0; extra == 'dev'
+Provides-Extra: extensions
+Requires-Dist: zettelforge-enterprise>=2.1.0; extra == 'extensions'
+Provides-Extra: langchain
+Requires-Dist: langchain-core>=0.2.0; extra == 'langchain'
+Provides-Extra: local
+Requires-Dist: llama-cpp-python>=0.3.0; extra == 'local'
+Provides-Extra: web
+Requires-Dist: fastapi>=0.100.0; extra == 'web'
+Requires-Dist: uvicorn>=0.20.0; extra == 'web'
+Description-Content-Type: text/markdown
+
+# ZettelForge
+
+<!-- mcp-name: io.github.rolandpg/zettelforge -->
+
+**The only agentic memory system built for cyber threat intelligence.**
+
+When a senior analyst leaves, two or three years of context walks out with them — customer environments, prior investigations, actor TTPs, false-positive patterns, every hard-won "wait, we've seen this before." ZettelForge is an agentic memory system built so that context stays with the team.
+
+It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes and threat reports, resolves aliases (APT28 = Fancy Bear = STRONTIUM = Sofacy), builds a STIX 2.1 knowledge graph, and serves every past investigation back to your analysts — and to Claude Code via MCP — in natural language. Runs entirely in-process. No API keys. No cloud. No data leaves the host.
+
+[![PyPI](https://img.shields.io/pypi/v/zettelforge)](https://pypi.org/project/zettelforge/)
+[![Downloads/month](https://static.pepy.tech/personalized-badge/zettelforge?period=month&units=international_system&left_color=grey&right_color=blue&left_text=downloads%2Fmonth)](https://pepy.tech/projects/zettelforge)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-green)](https://opensource.org/licenses/MIT)
+[![CI](https://github.com/rolandpg/zettelforge/actions/workflows/ci.yml/badge.svg)](https://github.com/rolandpg/zettelforge/actions)
+
+**[⭐ Star](https://github.com/rolandpg/zettelforge) · [📦 `pip install zettelforge`](https://pypi.org/project/zettelforge/) · [📖 Docs](https://docs.threatrecall.ai/) · [🧪 Hosted beta](https://threatrecall.ai)**
+
+<p align="center">
+<a href="https://www.buymeacoffee.com/xypher22pr0" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me a Coffee" style="height: 60px !important;width: 217px !important;" ></a>
+</p>
+<p align="center">
+  <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/demo.gif" width="720" alt="ZettelForge demo — CTI agentic memory in action">
+</p>
+
+> If ZettelForge fits a CTI workflow you run, a star is the fastest signal that this category is worth continuing to invest in.
+
+## The problem
+
+Every SOC loses analysts. When they leave, investigation context, actor attribution, and environment-specific false-positive patterns go with them. Their replacements re-open the same tickets, re-read the same reports, and re-build the same mental models from scratch.
+
+General-purpose AI memory systems don't fix this for security teams. They can't tell APT28 from Fancy Bear, don't know that CVE-2024-3094 is the XZ Utils backdoor, can't parse Sigma or YARA, and have no concept of MITRE ATT&CK technique IDs. When a CTI analyst gives them a year of intel reports, they get back fuzzy semantic search over chat history.
+
+ZettelForge was built for analysts who think in threat graphs. It extracts CVEs, threat actors, IOCs, and ATT&CK techniques automatically, resolves aliases across naming conventions, builds a knowledge graph with causal relationships, and retrieves memories using intent-aware blended search — all in-process, with no external API dependency.
+
+>"Memory augmentation closes 33% of the gap between small and large models on CTI tasks (CTI-REALM, Microsoft 2026)." [1]
+
+| Capability | ZettelForge | Mem0 | Graphiti | Cognee |
+|---|---|---|---|---|
+| CTI entity extraction (CVEs, actors, IOCs) | Yes | No | No | No |
+| STIX 2.1 ontology | Yes | No | No | No |
+| Threat actor alias resolution | Yes (APT28 = Fancy Bear) | No | No | No |
+| Knowledge graph with causal triples | Yes | No | Yes | Yes |
+| Intent-classified retrieval (5 types) | Yes | No | No | No |
+| In-process / no external API required | Yes | No | No | No |
+| Audit logs in OCSF schema | Yes | No | No | No |
+| MCP server (Claude Code) | Yes | No | No | No |
+
+## Data Pipeline
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture-light.svg">
+    <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — neural recall loop: ingest, enrich, retrieve, synthesize, backed by SQLite + LanceDB">
+  </picture>
+</p>
+
+
+## Features
+
+**Entity Extraction** — Automatically identifies CVEs, threat actors, IOCs (IPs, domains, hashes, URLs, emails), MITRE ATT&CK techniques, campaigns, intrusion sets, tools, people, locations, and organizations. Regex + LLM NER with STIX 2.1 types throughout.
+
+**Knowledge Graph** — Entities become nodes, co-occurrence becomes edges. LLM infers causal triples ("APT28 *uses* Cobalt Strike"). Temporal edges and supersession track how intelligence evolves.
+
+**Alias Resolution** — APT28, Fancy Bear, Sofacy, STRONTIUM all resolve to the same actor node. Works automatically on store and recall.
+
+**Blended Retrieval** — Vector similarity (768-dim fastembed, ONNX) + graph traversal (BFS over knowledge graph edges), weighted by intent classification. Five intent types: factual, temporal, relational, exploratory, causal.
+
+**Memory Evolution** — With `evolve=True`, new intel is compared to existing memory. LLM decides ADD, UPDATE, DELETE, or NOOP. Stale intel gets superseded. Contradictions get resolved. Duplicates get skipped.
+
+**RAG Synthesis** — Synthesize answers across all stored memories with `direct_answer` format.
+
+**In-process by architecture** — fastembed (ONNX) for embeddings, llama-cpp-python for optional local LLM inference, SQLite + LanceDB for storage, and Ollama on localhost by default. No external API keys are required. Outbound network access may occur on first run when embedding/LLM models are downloaded; after models are preloaded, it can run fully offline (including on air-gapped hosts).
+
+**Audit logging in OCSF schema** — Every operation emits a structured event in the Open Cybersecurity Schema Framework format. What you do with the log stream (SIEM, WORM store, nothing) is up to you.
+
+## Quick Start
+
+```bash
+pip install zettelforge
+```
+
+```python
+from zettelforge import MemoryManager
+
+mm = MemoryManager()
+
+# Store threat intel — entities extracted automatically
+mm.remember("APT28 uses Cobalt Strike for lateral movement via T1021")
+
+# Recall with alias resolution
+results = mm.recall("What tools does Fancy Bear use?")
+# Returns the APT28 note (APT28 = Fancy Bear, resolved automatically)
+
+# Synthesize across all memories
+answer = mm.synthesize("Summarize known APT28 TTPs")
+```
+
+No TypeDB, no Ollama, no Docker — just `pip install`. Embeddings run in-process via fastembed. LLM features (extraction, synthesis) activate when Ollama is available.
+
+### With Ollama (enables LLM features)
+
+```bash
+ollama pull qwen2.5:3b && ollama serve
+# ZettelForge auto-detects Ollama for extraction and synthesis
+```
+
+### Memory Evolution
+
+```python
+# New intel arrives — evolve=True enables memory evolution:
+# LLM extracts facts, compares to existing notes, decides ADD/UPDATE/DELETE/NOOP
+mm.remember(
+    "APT28 has shifted tactics. They dropped DROPBEAR and now exploit edge devices.",
+    domain="cti",
+    evolve=True,   # existing APT28 note gets superseded, not duplicated
+)
+```
+
+## How It Works
+
+Every `remember()` call triggers a pipeline:
+
+1. **Entity Extraction** — regex + LLM NER identifies CVEs, intrusion sets, threat actors, tools, campaigns, ATT&CK techniques, IOCs (IPv4, domain, URL, MD5/SHA1/SHA256, email), people, locations, organizations, events, activities, and temporal references (19 types)
+2. **Knowledge Graph Update** — entities become nodes, co-occurrence becomes edges, LLM infers causal triples
+3. **Vector Embedding** — 768-dim fastembed (ONNX, in-process, 7ms/embed) stored in LanceDB
+4. **Supersession Check** — entity overlap detection marks stale notes as superseded
+5. **Dual-Stream Write** — fast path returns in ~45ms; causal enrichment is deferred to a background worker
+
+Every `recall()` call blends two retrieval strategies:
+
+1. **Vector similarity** — semantic search over embeddings
+2. **Graph traversal** — BFS over knowledge graph edges, scored by hop distance
+3. **Intent routing** — query classified as factual/temporal/relational/causal/exploratory, weights adjusted per type
+4. **Cross-encoder reranking** — ms-marco-MiniLM reorders final results by relevance
+
+## Benchmarks
+
+Evaluated against published academic benchmarks:
+
+| Benchmark | What it measures | Score |
+|---|---|---|
+| **CTI Retrieval** | Attribution, CVE linkage, multi-hop | **75.0%** |
+| **RAGAS** | Retrieval quality (keyword presence) | **78.1%** |
+| **LOCOMO** (ACL 2024) | Conversational memory recall | **22.0%** *(with Ollama cloud models)* |
+
+See the [full benchmark report](benchmarks/BENCHMARK_REPORT.md) for methodology and analysis.
+
+## MCP Server (Claude Code)
+
+Add ZettelForge as a memory backend for Claude Code:
+
+```json
+{
+  "mcpServers": {
+    "zettelforge": {
+      "command": "python3",
+      "args": ["-m", "zettelforge.mcp"]
+    }
+  }
+}
+```
+
+Your Claude Code agent can now remember and recall threat intelligence across sessions.
+
+Exposed tools: `remember`, `recall`, `synthesize`, `entity`, `graph`, `stats`.
+
+## Detection Rules as Memory (Sigma + YARA)
+
+Sigma and YARA rules are first-class memory primitives. Parse, validate, and ingest a rule and its tags become graph edges: MITRE ATT&CK techniques, CVEs, threat-actor aliases, tools, and malware families resolve against the same ontology as every other note. A shared `DetectionRule` supertype carries `SigmaRule` and `YaraRule` subtypes, so a single rule UUID is addressable across both formats.
+
+Sigma rules are validated against the vendored [SigmaHQ JSON schema](https://github.com/SigmaHQ/sigma-specification). YARA rules are parsed with plyara and checked against the [CCCS YARA metadata standard](https://github.com/CybercentreCanada/CCCS-Yara) (tiers: `strict`, `warn`, `non_cccs`). Ingest is idempotent — re-ingesting an unchanged rule returns the original note via a content-hashed `source_ref`.
+
+```python
+from zettelforge import MemoryManager
+from zettelforge.sigma import ingest_rule as ingest_sigma
+from zettelforge.yara import ingest_rule as ingest_yara
+
+mm = MemoryManager()
+ingest_sigma("rules/proc_creation_win_office_macro.yml", mm)
+ingest_yara("rules/webshell_china_chopper.yar", mm, tier="warn")
+```
+
+```bash
+# Bulk ingest from SigmaHQ or a private rule repo
+python -m zettelforge.sigma.ingest /path/to/sigma/rules/
+python -m zettelforge.yara.ingest /path/to/yara/rules/ --tier warn
+
+# CI fixture check — parse + validate, no writes
+python -m zettelforge.sigma.ingest rules/ --dry-run
+```
+
+An LLM rule explainer (`zettelforge.detection.explainer.explain`) produces a structured JSON summary — intent, key fields, evasion notes, false-positive hypotheses — for any `DetectionRule`. It runs synchronously on demand in v1; async enrichment-queue wiring is v1.1. Rate-limited via `ZETTELFORGE_EXPLAIN_RPM` (default 60 calls/minute).
+
+References: [Sigma spec](https://github.com/SigmaHQ/sigma-specification), [SigmaHQ rules](https://github.com/SigmaHQ/sigma), [CCCS YARA](https://github.com/CybercentreCanada/CCCS-Yara), [YARA docs](https://yara.readthedocs.io).
+
+## Integrations
+
+### ATHF (Agentic Threat Hunting Framework)
+
+Ingest completed [ATHF](https://github.com/Nebulock-Inc/agentic-threat-hunting-framework) hunts into ZettelForge memory. MITRE techniques and IOCs are extracted and linked in the knowledge graph.
+
+```bash
+python examples/athf_bridge.py /path/to/hunts/
+# 12 hunt(s) parsed
+# Ingested 12/12 hunts into ZettelForge
+```
+
+See [examples/athf_bridge.py](examples/athf_bridge.py).
+
+
+## Extensions
+
+ZettelForge ships a complete agentic memory core. Everything documented above works from a single `pip install`.
+
+For teams that want TypeDB-scale graph storage, OpenCTI integration, or multi-tenant deployment, optional extensions are available:
+
+| Extension | What it adds |
+|---|---|
+| TypeDB STIX 2.1 backend | Schema-enforced ontology with inference rules |
+| OpenCTI sync | Bi-directional sync with OpenCTI instances |
+| Multi-tenant auth | OAuth/JWT with per-tenant isolation |
+| Sigma rule generation | Detection rules from extracted IOCs |
+
+Extensions install separately:
+
+```bash
+pip install zettelforge-enterprise
+```
+
+**Hosted (private beta):** [ThreatRecall](https://threatrecall.ai) is the managed SaaS version of ZettelForge with enterprise extensions enabled. Currently accepting waitlist signups and a limited number of design partners.
+
+## Configuration
+
+| Variable | Default | Description |
+|---|---|---|
+| `AMEM_DATA_DIR` | `~/.amem` | Data directory |
+| `ZETTELFORGE_BACKEND` | `sqlite` | SQLite community backend. TypeDB available via extension. |
+| `ZETTELFORGE_LLM_PROVIDER` | `local` | `local` (llama-cpp) or `ollama` |
+
+See [config.default.yaml](config.default.yaml) for all options.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup.
+
+## License
+
+MIT — See [LICENSE](LICENSE).
+
+## About the author
+
+Built by **Patrick Roland** — Director of SOC Services at Summit 7 Systems, where he built the Vigilance MxDR practice from the ground up. Navy nuclear veteran, CISSP, CCP (CMMC 2.0 Professional). [LinkedIn](https://www.linkedin.com/in/patrickgroland/).
+
+## Support the Project
+
+ZettelForge is MIT-licensed. If it's useful in your workflow and you'd like to help keep it maintained:
+
+<a href="https://www.buymeacoffee.com/xypher22pr0" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me a Coffee" style="height: 40px !important;width: 145px !important;" ></a>
+
+## Acknowledgments
+
+- Inspired by [Zettelkasten](https://en.wikipedia.org/wiki/Zettelkasten) and [A-Mem](https://arxiv.org/abs/2602.10715) (NeurIPS 2025)
+- Two-phase pipeline inspired by [Mem0](https://mem0.ai/research)
+- STIX 2.1 schema informed by [typedb-cti](https://github.com/typedb-osi/typedb-cti)
+- Benchmarked against [LOCOMO](https://snap-research.github.io/locomo/) (ACL 2024) and [CTIBench](https://arxiv.org/abs/2406.07599) (NeurIPS 2024)
+- [LanceDB](https://lancedb.com) | [fastembed](https://github.com/qdrant/fastembed) | [Pydantic](https://pydantic.dev) | [TypeDB](https://typedb.com)
+
+[1]: https://www.microsoft.com/en-us/security/blog/2026/03/20/cti-realm-a-new-benchmark-for-end-to-end-detection-rule-generation-with-ai-agents/