zettelforge 2.5.2__tar.gz → 2.7.0__tar.gz

{zettelforge-2.5.2 → zettelforge-2.7.0}/.github/workflows/ci.yml

@@ -102,7 +102,7 @@ jobs:
 
     - name: Upload coverage
       if: matrix.python-version == '3.12'
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
       with:
         file: ./coverage.xml
         fail_ci_if_error: false

zettelforge-2.7.0/.github/workflows/stale.yml

@@ -0,0 +1,47 @@
+name: Stale issue and PR management
+
+on:
+  schedule:
+    - cron: "0 9 * * 1"  # Every Monday at 09:00 UTC
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
+          # Issues
+          stale-issue-message: >
+            This issue has been inactive for 60 days. It will be closed
+            in 14 days unless there is new activity. If this is still
+            relevant, please comment to keep it open.
+          close-issue-message: >
+            This issue has been automatically closed after 14 days of
+            inactivity. It can be reopened at any time.
+          days-before-issue-stale: 60
+          days-before-issue-close: 14
+          stale-issue-label: stale
+          exempt-issue-labels: "p0,planned,help wanted,good first issue"
+
+          # PRs
+          stale-pr-message: >
+            This pull request has been inactive for 60 days. It will be
+            closed in 14 days unless there is new activity.
+          close-pr-message: >
+            This pull request has been automatically closed after 14 days
+            of inactivity.
+          days-before-pr-stale: 60
+          days-before-pr-close: 14
+          stale-pr-label: stale
+          exempt-pr-labels: "draft,work-in-progress"
+
+          # General
+          operations-per-run: 100
+          remove-stale-when-updated: true
+          delete-branch: false

{zettelforge-2.5.2 → zettelforge-2.7.0}/.gitignore

@@ -12,6 +12,17 @@ tasks/
 docs/.ralph/
 agentsync.md
 
+# Internal research/specs/plans — workspace scratch that contains
+# unredacted incident detail, customer references, and intermediate
+# reasoning. Kept on disk for the maintainer; not published.
+docs/superpowers/
+
+# Claude Code session artifacts — agent worktrees, transcripts, and
+# scratch state created by the maintainer's local tooling. Belt-and-
+# suspenders: these were never tracked, but listing them prevents an
+# accidental `git add -A` from sweeping them in.
+.claude/
+
 # MkDocs build output (regenerated from docs/)
 site/
 
@@ -28,6 +39,8 @@ downloads/
 eggs/
 .eggs/
 lib/
+!web/ui/js/lib/
+!web/ui/js/lib/*.js
 lib64/
 parts/
 sdist/

{zettelforge-2.5.2 → zettelforge-2.7.0}/CHANGELOG.md

@@ -6,6 +6,169 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.7.0] - 2026-05-26
+
+Security and OSINT release. Adds the RFC-016 OSINT layer and the first
+SEC-011 / MemSAD-inspired write-time memory-poisoning defense. No data
+migration is required. The new memory defense ships in audit mode by default.
+
+### Added
+
+- **OSINT layer scaffold and Phase 1 collectors** (RFC-016). Adds
+  `zettelforge.osint` with infrastructure, breach, people, social, and
+  technology collector packages; OSINT ontology and relation extensions;
+  entity canonicalization helpers; collector registry; and tests covering
+  DNS, WHOIS, certificates, BGP, ports, breach, people, social, and tech
+  collector contracts. Optional runtime dependencies are available with
+  `pip install zettelforge[osint]`.
+- **Write-time memory anomaly defense** (SEC-011 / MemSAD). New
+  `MemoryAnomalyGate` scores candidate notes before persistence using
+  MemSAD-style max/mean embedding similarity against recent domain
+  calibration notes plus character n-gram Jensen-Shannon divergence to
+  reduce synonym/paraphrase evasion. Config lives under
+  `governance.memory_defense`; default mode is `audit`, with `block` and
+  `quarantine` available once a deployment has a clean calibration corpus.
+- **Quarantine path for rejected memory writes.** In `quarantine` mode,
+  flagged notes are written to JSONL forensic quarantine and are not exposed
+  to recall, entity lookup, LanceDB, or graph traversal.
+- **CrewAI integration** (issue #40). New optional extra
+  `pip install zettelforge[crewai]` exposes `ZettelForgeRecallTool`,
+  `ZettelForgeRememberTool`, and `ZettelForgeSynthesizeTool` as CrewAI
+  `BaseTool` subclasses. CTI-focused crews can now use ZettelForge as a
+  drop-in alternative to CrewAI's existing Mem0 memory tools, with
+  per-tool description copy aimed at routing the LLM to the right tool
+  (recall for lookups, remember for findings, synthesize for final answers).
+  See `examples/crewai_cti_crew.py` for a runnable two-agent demo.
+  Tests gated on `pytest.importorskip("crewai")`; 11 pass against
+  crewai 1.14.x.
+
+### Changed
+
+- **Telemetry attribution compatibility.** `caller` is now supported in
+  telemetry events while the previous `actor` field and method arguments
+  remain backward-compatible for existing dashboards and tests.
+- **Real LLM integration and performance tests are explicit opt-in.**
+  Set `ZETTELFORGE_RUN_LLM_INTEGRATION=1` or
+  `ZETTELFORGE_RUN_PERFORMANCE_TESTS=1` to run environment-sensitive suites.
+  The default regression suite is now deterministic on machines without
+  local LLM credentials or dedicated benchmark hardware.
+
+### Tests
+
+- Added focused memory-defense tests for insufficient calibration, audit-mode
+  anomaly detection, and quarantine writes.
+- Default regression gate: `742 passed, 13 skipped`.
+
+## [2.6.2] - 2026-04-27
+
+UI/UX release. Fixes the `/config` page so the Apply button actually works
+and surfaces enum-style settings as dropdowns instead of free-text inputs.
+No data migration. No config changes. No API contract changes.
+
+### Fixed
+
+- **`/config` "Save Changes" button is no longer dead.** The Quick Settings
+  panel called `saveConfigForm()` and `reloadConfig()` — neither function
+  was defined anywhere, so the button silently no-op'd and the panel
+  rendered "Loading schema..." forever. Replaced with a real form-based
+  editor whose Apply button PUTs a nested payload to `/api/config` and
+  reloads from server on success.
+
+### Added
+
+- **Form-based config editor with dropdowns.** `/config` now renders a
+  grouped settings form alongside the YAML editor. Known enum fields
+  (`backend`, `embedding.provider`, `llm.provider`, `llm.local_backend`,
+  `logging.level`, `synthesis.default_format`, `governance.pii.action`)
+  render as `<select>` controls instead of free-text inputs. Restart-
+  required leaves get a "restart required" badge sourced from the same
+  set the server uses, so the UI warning is never out of sync with the
+  server's classification.
+- **Pending-changes counter and Revert button.** The form tracks dirty
+  fields by dotted path, builds a single nested payload on Apply, and
+  shows `N pending change(s) (M need restart)` next to the buttons.
+- **YAML editor accepts both YAML and JSON** (was JSON-only despite the
+  label) and skips redacted `***` secrets so they aren't PUT back as
+  literal strings.
+
+### Tests
+
+- 4 new tests in `tests/test_web_api.py`: dropdown enum round-trip for
+  `logging.level` (restart-required) and `synthesis.default_format` (live);
+  multi-section nested payload from a single Apply; and a regression guard
+  on the `/config` HTML structure (form tab, dropdown enum declarations,
+  restart-leaf flags, and proof the dead `saveConfigForm`/`reloadConfig`
+  handlers are gone). 28 passed, 2 skipped (was 24 + 2).
+
+## [2.6.1] - 2026-04-25
+
+Hotfix release. Resolves three blockers found in code review of the
+RFC-015 web GUI shipped in v2.6.0. No data migration. No config changes.
+
+### Fixed
+
+- **`/config` HTML page now renders.** `_to_dict` was defined as a closure
+  inside `get_config_endpoint`, so every render of `/config` raised
+  `NameError`, was silently swallowed by a bare `except`, and left the
+  YAML body blank on initial server-side render. Promoted to a module-level
+  `_config_to_dict` helper used by both routes. (PR #131)
+- **`PUT /api/config` correctly reports nested restart-required fields.**
+  The check compared top-level payload keys against a set of dotted-path
+  fields, so payloads like `{"embedding": {"provider": "x"}}` were
+  reported as `applied: ["embedding"]`, `pending_restart: []`, telling
+  operators a restart-required change had taken effect when it had not.
+  Added `_flatten_keys` to walk nested payloads to dotted leaf paths;
+  `applied` and `pending_restart` now contain accurate dotted paths.
+  (PR #131)
+- **`/config` HTML route is now auth-gated.** `/api/config` was protected,
+  but the HTML shell (and once the `_to_dict` bug was fixed, its
+  server-rendered YAML body) was reachable without an API key. Added
+  `Depends(require_api_guard)` and made the YAML body redact secrets
+  before serialization. (PR #131)
+
+### Tests
+
+- Added four regression tests in `tests/test_web_api.py` covering all
+  three fixes. 24 passed, 2 skipped (was 20 + 2).
+
+## [2.6.0] - 2026-04-25
+
+Feature release. Adds configurable content-size limits for DoS mitigation
+(RFC-014) and moves per-call-site LLM token budgets out of hardcoded
+literals into `LLMConfig`, making them overridable at deploy time.
+
+### Added
+
+- **Configurable content size limits** (`GovernanceConfig.limits.max_content_length`,
+  default 50 MB). `remember()` calls with content exceeding the limit are
+  rejected with a clear error message. Set to `0` to disable the check.
+  Environment override: `ZETTELFORGE_LIMITS_MAX_CONTENT_LENGTH`.
+  (RFC-014, PR #123)
+- **Per-call-site `max_tokens` budgets configurable via `LLMConfig`**.
+  Five new fields: `max_tokens_causal` (8000), `max_tokens_synthesis` (2500),
+  `max_tokens_fact` (2500), `max_tokens_ner` (2500), `max_tokens_evolution` (2500).
+  Defaults match v2.5.2 values. No behavioral change for existing configs.
+  (PR #126, issue #125)
+
+### Changed
+
+- **Docs: config reconciliation for v2.5.2** — `config.default.yaml` gained
+  the `lance:` section (RFC-009 Phase 1.5), `docs/reference/configuration.md`
+  now covers all v2.5.2 knobs (`lance`, `pii`, per-call-site budgets), and
+  `docs/explanation/llm-budgets-and-timeouts.md` explains the reasoning-model
+  token-budget tradeoffs. (PR #126)
+- **`_apply_yaml()` now handles `lance:` section** — previously the
+  `lance.cleanup_interval_minutes` and `lance.cleanup_older_than_seconds` YAML
+  knobs were silently ignored (regression from RFC-009 Phase 1.5 landing in
+  v2.4.x without the `_apply_yaml` branch). (PR #126, code review finding)
+
+### Internal
+
+- **Removed `docs/superpowers/` from version control**. The directory holds
+  workspace scratch — internal research and notes with unredacted incident
+  detail. 18 files (7319 lines) untracked. No published content lost.
+  (PR #128)
+
 ## [2.5.2] - 2026-04-25
 
 Hotfix release. Restores end-to-end functionality of synthesis, causal

{zettelforge-2.5.2 → zettelforge-2.7.0}/CONTRIBUTING.md

@@ -37,6 +37,49 @@ If your contribution needs TypeDB or OpenCTI, open an issue to discuss.
 We keep the extension boundary clear so contributors know their work
 will always remain open source.
 
+### For major features: Start with an RFC
+
+If you're proposing a significant new feature (new subsystem, new backend,
+breaking API change), open an RFC before writing code. RFCs live in
+`docs/rfcs/` and follow the template from the existing RFCs in that
+directory. Open a Discussion first to socialize the idea, then file a
+draft RFC as a PR. This prevents wasted effort on work that won't be
+accepted.
+
+See [ROADMAP.md](ROADMAP.md) for the current priorities and what's
+planned for upcoming releases.
+
+### Good first issues
+
+Issues tagged [good first issue](https://github.com/rolandpg/zettelforge/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)
+have structured acceptance criteria in the issue body. Check the issue
+for: which files to edit, test expectations, and example input/output.
+If an issue is unclear, ask in the issue comments.
+
+## Issue triage
+
+This project is maintained by a solo developer (per GOV-006). Here is
+what you can expect:
+
+- **New issues**: triaged within 7 days. You will get a response (even
+  if it's "not planned, closing").
+- **Bug reports**: severity assessed within 7 days. P0 (crash, data
+  loss, security) gets a same-day response.
+- **Feature requests**: tagged with `enhancement` on creation. The
+  maintainer will add `planned`, `deferred`, or `won't fix` within 7
+  days.
+- **PR reviews**: first review within 14 days of submission. Smaller
+  PRs get reviewed faster.
+- **Stale issues**: issues with no activity for 60 days are tagged
+  `stale` and closed after 14 more days without response. This keeps
+  the tracker manageable for a solo maintainer.
+
+## Contributor recognition
+
+Every contributor is listed in [CONTRIBUTORS.md](CONTRIBUTORS.md),
+regardless of contribution size. If you submit a PR that gets merged,
+you will be added. If your name is missing, open a PR.
+
 ## Code Style
 
 - Follow PEP 8

zettelforge-2.7.0/CONTRIBUTORS.md

@@ -0,0 +1,17 @@
+# Contributors
+
+Thank you to everyone who has contributed to ZettelForge.
+
+## Maintainers
+
+- **Patrick G. Roland II** — creator and lead maintainer
+
+## Contributors
+
+This file tracks individuals who have contributed code, documentation, design, or other improvements. The maintainer updates it with each release.
+
+If you have contributed and your name is missing, please open a PR or issue.
+
+---
+
+*This project uses a "thank you, next" acknowledgment model. All contributors are listed regardless of contribution size. A typo fix counts.*