zettelforge 2.6.2__tar.gz → 2.7.0__tar.gz

{zettelforge-2.6.2 → zettelforge-2.7.0}/.github/workflows/ci.yml

@@ -102,7 +102,7 @@ jobs:
 
     - name: Upload coverage
       if: matrix.python-version == '3.12'
-      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
       with:
         file: ./coverage.xml
         fail_ci_if_error: false

{zettelforge-2.6.2 → zettelforge-2.7.0}/.github/workflows/stale.yml

@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 

{zettelforge-2.6.2 → zettelforge-2.7.0}/CHANGELOG.md

@@ -6,6 +6,59 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [2.7.0] - 2026-05-26
+
+Security and OSINT release. Adds the RFC-016 OSINT layer and the first
+SEC-011 / MemSAD-inspired write-time memory-poisoning defense. No data
+migration is required. The new memory defense ships in audit mode by default.
+
+### Added
+
+- **OSINT layer scaffold and Phase 1 collectors** (RFC-016). Adds
+  `zettelforge.osint` with infrastructure, breach, people, social, and
+  technology collector packages; OSINT ontology and relation extensions;
+  entity canonicalization helpers; collector registry; and tests covering
+  DNS, WHOIS, certificates, BGP, ports, breach, people, social, and tech
+  collector contracts. Optional runtime dependencies are available with
+  `pip install zettelforge[osint]`.
+- **Write-time memory anomaly defense** (SEC-011 / MemSAD). New
+  `MemoryAnomalyGate` scores candidate notes before persistence using
+  MemSAD-style max/mean embedding similarity against recent domain
+  calibration notes plus character n-gram Jensen-Shannon divergence to
+  reduce synonym/paraphrase evasion. Config lives under
+  `governance.memory_defense`; default mode is `audit`, with `block` and
+  `quarantine` available once a deployment has a clean calibration corpus.
+- **Quarantine path for rejected memory writes.** In `quarantine` mode,
+  flagged notes are written to JSONL forensic quarantine and are not exposed
+  to recall, entity lookup, LanceDB, or graph traversal.
+- **CrewAI integration** (issue #40). New optional extra
+  `pip install zettelforge[crewai]` exposes `ZettelForgeRecallTool`,
+  `ZettelForgeRememberTool`, and `ZettelForgeSynthesizeTool` as CrewAI
+  `BaseTool` subclasses. CTI-focused crews can now use ZettelForge as a
+  drop-in alternative to CrewAI's existing Mem0 memory tools, with
+  per-tool description copy aimed at routing the LLM to the right tool
+  (recall for lookups, remember for findings, synthesize for final answers).
+  See `examples/crewai_cti_crew.py` for a runnable two-agent demo.
+  Tests gated on `pytest.importorskip("crewai")`; 11 pass against
+  crewai 1.14.x.
+
+### Changed
+
+- **Telemetry attribution compatibility.** `caller` is now supported in
+  telemetry events while the previous `actor` field and method arguments
+  remain backward-compatible for existing dashboards and tests.
+- **Real LLM integration and performance tests are explicit opt-in.**
+  Set `ZETTELFORGE_RUN_LLM_INTEGRATION=1` or
+  `ZETTELFORGE_RUN_PERFORMANCE_TESTS=1` to run environment-sensitive suites.
+  The default regression suite is now deterministic on machines without
+  local LLM credentials or dedicated benchmark hardware.
+
+### Tests
+
+- Added focused memory-defense tests for insufficient calibration, audit-mode
+  anomaly detection, and quarantine writes.
+- Default regression gate: `742 passed, 13 skipped`.
+
 ## [2.6.2] - 2026-04-27
 
 UI/UX release. Fixes the `/config` page so the Apply button actually works

{zettelforge-2.6.2 → zettelforge-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zettelforge
-Version: 2.6.2
+Version: 2.7.0
 Summary: ZettelForge: Agentic Memory System with vector search, knowledge graph, and synthesis
 Project-URL: Homepage, https://github.com/rolandpg/zettelforge
 Project-URL: Documentation, https://docs.threatrecall.ai
@@ -35,8 +35,12 @@ Requires-Dist: pyyaml>=6.0
 Requires-Dist: requests>=2.31.0
 Requires-Dist: structlog>=24.0.0
 Requires-Dist: tantivy>=0.11.0
+Provides-Extra: crewai
+Requires-Dist: crewai>=1.14.0; extra == 'crewai'
 Provides-Extra: dev
+Requires-Dist: dnspython>=2.4.0; extra == 'dev'
 Requires-Dist: fastapi>=0.100.0; extra == 'dev'
+Requires-Dist: ipwhois>=1.2.0; extra == 'dev'
 Requires-Dist: jinja2>=3.0.0; extra == 'dev'
 Requires-Dist: langchain-core>=0.2.0; extra == 'dev'
 Requires-Dist: mypy>=1.0.0; extra == 'dev'
@@ -44,6 +48,7 @@ Requires-Dist: psutil>=5.9.0; extra == 'dev'
 Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
 Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
 Requires-Dist: pytest>=7.0.0; extra == 'dev'
+Requires-Dist: python-whois>=0.9.0; extra == 'dev'
 Requires-Dist: ruff>=0.4.0; extra == 'dev'
 Requires-Dist: uvicorn>=0.20.0; extra == 'dev'
 Provides-Extra: extensions
@@ -59,6 +64,10 @@ Requires-Dist: llama-cpp-python>=0.3.0; extra == 'local-all'
 Requires-Dist: onnxruntime-genai>=0.4.0; extra == 'local-all'
 Provides-Extra: local-onnx
 Requires-Dist: onnxruntime-genai>=0.4.0; extra == 'local-onnx'
+Provides-Extra: osint
+Requires-Dist: dnspython>=2.4.0; extra == 'osint'
+Requires-Dist: ipwhois>=1.2.0; extra == 'osint'
+Requires-Dist: python-whois>=0.9.0; extra == 'osint'
 Provides-Extra: pii
 Requires-Dist: presidio-analyzer>=2.2.0; extra == 'pii'
 Requires-Dist: presidio-anonymizer>=2.2.0; extra == 'pii'
@@ -82,18 +91,18 @@ It extracts CVEs, threat actors, IOCs, and ATT&CK techniques from analyst notes
 
 [![PyPI](https://img.shields.io/pypi/v/zettelforge)](https://pypi.org/project/zettelforge/)
 [![Downloads/month](https://static.pepy.tech/personalized-badge/zettelforge?period=month&units=international_system&left_color=grey&right_color=blue&left_text=downloads%2Fmonth)](https://pepy.tech/projects/zettelforge)
+[![Star History](https://api.star-history.com/svg?repos=rolandpg/zettelforge&type=Date)](https://star-history.com/#rolandpg/zettelforge&Date)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/downloads/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-green)](https://opensource.org/licenses/MIT)
 [![CI](https://github.com/rolandpg/zettelforge/actions/workflows/ci.yml/badge.svg)](https://github.com/rolandpg/zettelforge/actions)
 [![Open Issues](https://img.shields.io/github/issues/rolandpg/zettelforge?color=blue)](https://github.com/rolandpg/zettelforge/issues)
 
-**[⭐ Star](https://github.com/rolandpg/zettelforge) · [📦 `pip install zettelforge`](https://pypi.org/project/zettelforge/) · [📖 Docs](https://docs.threatrecall.ai/) · [🧪 Hosted beta](https://threatrecall.ai) · [🗺️ Roadmap](ROADMAP.md)**
+**[Star](https://github.com/rolandpg/zettelforge) · [`pip install zettelforge`](https://pypi.org/project/zettelforge/) · [Docs](https://docs.threatrecall.ai/) · [ThreatRecall (hosted)](https://threatrecall.ai) · [Changelog](CHANGELOG.md)**
+
+> **v2.6.2** (2026-04-27): Config web editor ships with working dropdowns for all enum fields (LLM/embedding provider, log level, PII action, synthesis format) and a working Apply button. New `[crewai]` extra exposes ZettelForge as CrewAI tools -- `pip install zettelforge[crewai]`. [Full changelog](CHANGELOG.md)
 
 <p align="center">
-<a href="https://www.buymeacoffee.com/xypher22pr0" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me a Coffee" style="height: 60px !important;width: 217px !important;" ></a>
-</p>
-<p align="center">
-  <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/demo.gif" width="720" alt="ZettelForge demo — CTI agentic memory in action">
+  <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/demo.gif" width="720" alt="ZettelForge demo -- CTI agentic memory in action">
 </p>
 
 > If ZettelForge fits a CTI workflow you run, a star is the fastest signal that this category is worth continuing to invest in.
@@ -104,9 +113,9 @@ Every SOC loses analysts. When they leave, investigation context, actor attribut
 
 General-purpose AI memory systems don't fix this for security teams. They can't tell APT28 from Fancy Bear, don't know that CVE-2024-3094 is the XZ Utils backdoor, can't parse Sigma or YARA, and have no concept of MITRE ATT&CK technique IDs. When a CTI analyst gives them a year of intel reports, they get back fuzzy semantic search over chat history.
 
-ZettelForge was built for analysts who think in threat graphs. It extracts CVEs, threat actors, IOCs, and ATT&CK techniques automatically, resolves aliases across naming conventions, builds a knowledge graph with causal relationships, and retrieves memories using intent-aware blended search — all in-process, with no external API dependency.
+ZettelForge was built for analysts who think in threat graphs. It extracts CVEs, threat actors, IOCs, and ATT&CK techniques automatically, resolves aliases across naming conventions, builds a knowledge graph with causal relationships, and retrieves memories using intent-aware blended search -- all in-process, with no external API dependency.
 
->"Memory augmentation closes 33% of the gap between small and large models on CTI tasks (CTI-REALM, Microsoft 2026)." [1]
+> Memory augmentation closes 33% of the gap between small and large models on CTI tasks ([CTI-REALM, Microsoft 2026](https://www.microsoft.com/en-us/security/blog/2026/03/20/cti-realm-a-new-benchmark-for-end-to-end-detection-rule-generation-with-ai-agents/), using GPT-4 as the large-model baseline). See [full benchmark report](benchmarks/BENCHMARK_REPORT.md) for methodology and comparisons.
 
 | Capability | ZettelForge | Mem0 | Graphiti | Cognee |
 |---|---|---|---|---|
@@ -124,31 +133,33 @@ ZettelForge was built for analysts who think in threat graphs. It extracts CVEs,
   <picture>
     <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg">
     <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture-light.svg">
-    <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture — neural recall loop: ingest, enrich, retrieve, synthesize, backed by SQLite + LanceDB">
+    <img src="https://raw.githubusercontent.com/rolandpg/zettelforge/master/docs/assets/zettelforge_architecture.svg" width="720" alt="ZettelForge architecture -- neural recall loop: ingest, enrich, retrieve, synthesize, backed by SQLite + LanceDB">
   </picture>
 </p>
 
 
 ## Features
 
-**Entity Extraction** — Automatically identifies CVEs, threat actors, IOCs (IPs, domains, hashes, URLs, emails), MITRE ATT&CK techniques, campaigns, intrusion sets, tools, people, locations, and organizations. Regex + LLM NER with STIX 2.1 types throughout.
+**Entity Extraction** -- Automatically identifies CVEs, threat actors, IOCs (IPs, domains, hashes, URLs, emails), MITRE ATT&CK techniques, campaigns, intrusion sets, tools, people, locations, and organizations. Regex + LLM NER with STIX 2.1 types throughout.
 
-**Knowledge Graph** — Entities become nodes, co-occurrence becomes edges. LLM infers causal triples ("APT28 *uses* Cobalt Strike"). Temporal edges and supersession track how intelligence evolves.
+**Knowledge Graph** -- Entities become nodes, co-occurrence becomes edges. LLM infers causal triples ("APT28 *uses* Cobalt Strike"). Temporal edges and supersession track how intelligence evolves.
 
-**Alias Resolution** — APT28, Fancy Bear, Sofacy, STRONTIUM all resolve to the same actor node. Works automatically on store and recall.
+**Alias Resolution** -- APT28, Fancy Bear, Sofacy, STRONTIUM all resolve to the same actor node. Works automatically on store and recall.
 
-**Blended Retrieval** — Vector similarity (768-dim fastembed, ONNX) + graph traversal (BFS over knowledge graph edges), weighted by intent classification. Five intent types: factual, temporal, relational, exploratory, causal.
+**Blended Retrieval** -- Vector similarity (768-dim fastembed, ONNX) + graph traversal (BFS over knowledge graph edges), weighted by intent classification. Five intent types: factual, temporal, relational, exploratory, causal.
 
-**Memory Evolution** — With `evolve=True`, new intel is compared to existing memory. LLM decides ADD, UPDATE, DELETE, or NOOP. Stale intel gets superseded. Contradictions get resolved. Duplicates get skipped.
+**Memory Evolution** -- With `evolve=True`, new intel is compared to existing memory. LLM decides ADD, UPDATE, DELETE, or NOOP. Stale intel gets superseded. Contradictions get resolved. Duplicates get skipped.
 
-**RAG Synthesis** — Synthesize answers across all stored memories with `direct_answer` format.
+**RAG Synthesis** -- Synthesize answers across all stored memories with `direct_answer` format.
 
-**In-process by architecture** — fastembed (ONNX) for embeddings, llama-cpp-python for optional local LLM inference, SQLite + LanceDB for storage, and Ollama on localhost by default. No external API keys are required. Outbound network access may occur on first run when embedding/LLM models are downloaded; after models are preloaded, it can run fully offline (including on air-gapped hosts).
+**In-process by architecture** -- fastembed (ONNX) for embeddings, llama-cpp-python for optional local LLM inference, SQLite + LanceDB for storage, and Ollama on localhost by default. No external API keys are required. Outbound network access may occur on first run when embedding/LLM models are downloaded; after models are preloaded, it can run fully offline (including on air-gapped hosts).
 
-**Audit logging in OCSF schema** — Every operation emits a structured event in the Open Cybersecurity Schema Framework format. What you do with the log stream (SIEM, WORM store, nothing) is up to you.
+**Audit logging in OCSF schema** -- Every operation emits a structured event in the Open Cybersecurity Schema Framework format. What you do with the log stream (SIEM, WORM store, nothing) is up to you.
 
 ## Quick Start
 
+### 30-second hello world (no LLM required)
+
 ```bash
 pip install zettelforge
 ```
@@ -158,30 +169,37 @@ from zettelforge import MemoryManager
 
 mm = MemoryManager()
 
-# Store threat intel — entities extracted automatically
+# Store CTI -- entities (CVEs, actors, ATT&CK IDs, IOCs) extracted via regex
 mm.remember("APT28 uses Cobalt Strike for lateral movement via T1021")
+mm.remember("APT28 (Fancy Bear) targets NATO defense contractors with spear-phishing")
+mm.remember("CVE-2024-3094 is the XZ Utils backdoor (CVSS 10.0) affecting sshd")
 
-# Recall with alias resolution
-results = mm.recall("What tools does Fancy Bear use?")
-# Returns the APT28 note (APT28 = Fancy Bear, resolved automatically)
-
-# Synthesize across all memories
-answer = mm.synthesize("Summarize known APT28 TTPs")
+# Recall blends vector + graph search; alias resolution kicks in (Fancy Bear -> APT28)
+for note in mm.recall("What tools does Fancy Bear use?", k=3):
+    print(f"[{note.metadata.tier}] {note.content.raw}")
 ```
 
-No TypeDB, no Ollama, no Docker — just `pip install`. Embeddings run in-process via fastembed. LLM features (extraction, synthesis) activate when Ollama is available.
+That works on a fresh `pip install` with no external services. Embeddings run in-process via fastembed (~80MB ONNX model downloaded on first call). `MemoryManager()` writes to `~/.amem/` by default; override with `ZETTELFORGE_DATA_DIR` or via config. A runnable copy lives at [`examples/quickstart.py`](examples/quickstart.py).
 
-### With Ollama (enables LLM features)
+### Add an LLM for synthesis and richer extraction
 
 ```bash
-ollama pull qwen2.5:3b && ollama serve
-# ZettelForge auto-detects Ollama for extraction and synthesis
+ollama pull qwen3.5:9b && ollama serve
 ```
 
+```python
+# With Ollama running, synthesize() returns a real summary across stored notes
+answer = mm.synthesize("Summarize known APT28 TTPs")
+print(answer["synthesis"]["answer"])
+# Background LLM NER also enriches stored notes with additional entities
+```
+
+ZettelForge auto-detects Ollama. To use a different provider (`local` llama-cpp, `litellm` for 100+ providers, `mock` for tests), see [Configuration](#configuration). Without an LLM, `synthesize()` still returns a structured response but the `answer` field is a fallback placeholder -- only `remember` and `recall` produce useful results in pip-only mode.
+
 ### Memory Evolution
 
 ```python
-# New intel arrives — evolve=True enables memory evolution:
+# New intel arrives -- evolve=True enables memory evolution:
 # LLM extracts facts, compares to existing notes, decides ADD/UPDATE/DELETE/NOOP
 mm.remember(
     "APT28 has shifted tactics. They dropped DROPBEAR and now exploit edge devices.",
@@ -194,55 +212,77 @@ mm.remember(
 
 Every `remember()` call triggers a pipeline:
 
-1. **Entity Extraction** — regex + LLM NER identifies CVEs, intrusion sets, threat actors, tools, campaigns, ATT&CK techniques, IOCs (IPv4, domain, URL, MD5/SHA1/SHA256, email), people, locations, organizations, events, activities, and temporal references (19 types)
-2. **Knowledge Graph Update** — entities become nodes, co-occurrence becomes edges, LLM infers causal triples
-3. **Vector Embedding** — 768-dim fastembed (ONNX, in-process, 7ms/embed) stored in LanceDB
-4. **Supersession Check** — entity overlap detection marks stale notes as superseded
-5. **Dual-Stream Write** — fast path returns in ~45ms; causal enrichment is deferred to a background worker
+1. **Entity Extraction** -- regex + LLM NER identifies CVEs, intrusion sets, threat actors, tools, campaigns, ATT&CK techniques, IOCs (IPv4, domain, URL, MD5/SHA1/SHA256, email), people, locations, organizations, events, activities, and temporal references (19 types)
+2. **Knowledge Graph Update** -- entities become nodes, co-occurrence becomes edges, LLM infers causal triples
+3. **Vector Embedding** -- 768-dim fastembed (ONNX, in-process, 7ms/embed) stored in LanceDB
+4. **Supersession Check** -- entity overlap detection marks stale notes as superseded
+5. **Dual-Stream Write** -- fast path returns in ~45ms; causal enrichment is deferred to a background worker
 
 Every `recall()` call blends two retrieval strategies:
 
-1. **Vector similarity** — semantic search over embeddings
-2. **Graph traversal** — BFS over knowledge graph edges, scored by hop distance
-3. **Intent routing** — query classified as factual/temporal/relational/causal/exploratory, weights adjusted per type
-4. **Cross-encoder reranking** — ms-marco-MiniLM reorders final results by relevance
+1. **Vector similarity** -- semantic search over embeddings
+2. **Graph traversal** -- BFS over knowledge graph edges, scored by hop distance
+3. **Intent routing** -- query classified as factual/temporal/relational/causal/exploratory, weights adjusted per type
+4. **Cross-encoder reranking** -- ms-marco-MiniLM reorders final results by relevance
 
-## Benchmarks
+## Use ZettelForge in Claude Desktop in 60 seconds
 
-Evaluated against published academic benchmarks:
-
-| Benchmark | What it measures | Score |
-|---|---|---|
-| **CTI Retrieval** | Attribution, CVE linkage, multi-hop | **75.0%** |
-| **RAGAS** | Retrieval quality (keyword presence) | **78.1%** |
-| **LOCOMO** (ACL 2024) | Conversational memory recall | **22.0%** *(with Ollama cloud models)* |
+```bash
+pip install zettelforge
+```
 
-See the [full benchmark report](benchmarks/BENCHMARK_REPORT.md) for methodology and analysis.
+Create or edit `.claude.json` in your project root (or `~/.claude/.claude.json` for global access):
 
-## MCP Server (Claude Code)
+```json
+{
+  "mcpServers": {
+    "zettelforge": {
+      "command": "python3",
+      "args": ["-m", "zettelforge.mcp"]
+    }
+  }
+}
+```
 
-Add ZettelForge as a memory backend for Claude Code:
+If ZettelForge is installed in a virtual environment, use the full path to that Python interpreter:
 
 ```json
 {
   "mcpServers": {
     "zettelforge": {
-      "command": "python3",
+      "command": "/home/user/.venvs/zettelforge/bin/python",
       "args": ["-m", "zettelforge.mcp"]
     }
   }
 }
 ```
 
-Your Claude Code agent can now remember and recall threat intelligence across sessions.
+Start Claude Code and verify the tools are available:
+
+```bash
+claude
+# Inside the session, ask: "What tools do you have available from zettelforge?"
+```
+
+Seven tools are exposed: `zettelforge_remember`, `zettelforge_recall`, `zettelforge_synthesize`, `zettelforge_entity`, `zettelforge_graph`, `zettelforge_stats`, and `zettelforge_sync` (requires enterprise package). See the [MCP protocol reference](docs/reference/mcp-protocol.md) for full schemas, JSON-RPC request/response examples, error codes, and the lazy-singleton lifecycle. For troubleshooting, virtualenv paths, and manual tool testing, see [set-up-mcp-server](docs/how-to/set-up-mcp-server.md).
+
+## Benchmarks
+
+Evaluated against published academic benchmarks:
+
+| Benchmark | What it measures | Score |
+|---|---|---|
+| **CTI Retrieval** (CTIBench subset) | Attribution, CVE linkage, multi-hop | **75.0%** |
+| **RAGAS** | Retrieval quality (keyword presence) | **78.1%** |
+| **LOCOMO** (ACL 2024) | Conversational memory recall | **22.0%** |
 
-Exposed tools: `remember`, `recall`, `synthesize`, `entity`, `graph`, `stats`.
+The **Score** column reports ZettelForge measurements run with Ollama-hosted models, with one exception: the LOCOMO row was re-measured at v2.1.1 using an Ollama cloud judge for evaluation grading (not local generation). See the [full benchmark report](benchmarks/BENCHMARK_REPORT.md) for benchmark-specific methodology, version history, and per-suite judge configuration.
 
 ## Detection Rules as Memory (Sigma + YARA)
 
 Sigma and YARA rules are first-class memory primitives. Parse, validate, and ingest a rule and its tags become graph edges: MITRE ATT&CK techniques, CVEs, threat-actor aliases, tools, and malware families resolve against the same ontology as every other note. A shared `DetectionRule` supertype carries `SigmaRule` and `YaraRule` subtypes, so a single rule UUID is addressable across both formats.
 
-Sigma rules are validated against the vendored [SigmaHQ JSON schema](https://github.com/SigmaHQ/sigma-specification). YARA rules are parsed with plyara and checked against the [CCCS YARA metadata standard](https://github.com/CybercentreCanada/CCCS-Yara) (tiers: `strict`, `warn`, `non_cccs`). Ingest is idempotent — re-ingesting an unchanged rule returns the original note via a content-hashed `source_ref`.
+Sigma rules are validated against the vendored [SigmaHQ JSON schema](https://github.com/SigmaHQ/sigma-specification). YARA rules are parsed with plyara and checked against the [CCCS YARA metadata standard](https://github.com/CybercentreCanada/CCCS-Yara) (tiers: `strict`, `warn`, `non_cccs`). Ingest is idempotent -- re-ingesting an unchanged rule returns the original note via a content-hashed `source_ref`.
 
 ```python
 from zettelforge import MemoryManager
@@ -259,11 +299,11 @@ ingest_yara("rules/webshell_china_chopper.yar", mm, tier="warn")
 python -m zettelforge.sigma.ingest /path/to/sigma/rules/
 python -m zettelforge.yara.ingest /path/to/yara/rules/ --tier warn
 
-# CI fixture check — parse + validate, no writes
+# CI fixture check -- parse + validate, no writes
 python -m zettelforge.sigma.ingest rules/ --dry-run
 ```
 
-An LLM rule explainer (`zettelforge.detection.explainer.explain`) produces a structured JSON summary — intent, key fields, evasion notes, false-positive hypotheses — for any `DetectionRule`. It runs synchronously on demand in v1; async enrichment-queue wiring is v1.1. Rate-limited via `ZETTELFORGE_EXPLAIN_RPM` (default 60 calls/minute).
+An LLM rule explainer (`zettelforge.detection.explainer.explain`) produces a structured JSON summary -- intent, key fields, evasion notes, false-positive hypotheses -- for any `DetectionRule`. It runs synchronously on demand in v1; async enrichment-queue wiring is v1.1. Rate-limited via `ZETTELFORGE_EXPLAIN_RPM` (default 60 calls/minute).
 
 References: [Sigma spec](https://github.com/SigmaHQ/sigma-specification), [SigmaHQ rules](https://github.com/SigmaHQ/sigma), [CCCS YARA](https://github.com/CybercentreCanada/CCCS-Yara), [YARA docs](https://yara.readthedocs.io).
 
@@ -282,26 +322,18 @@ python examples/athf_bridge.py /path/to/hunts/
 See [examples/athf_bridge.py](examples/athf_bridge.py).
 
 
-## Extensions
+## ThreatRecall (Hosted)
 
-ZettelForge ships a complete agentic memory core. Everything documented above works from a single `pip install`.
+[ThreatRecall](https://threatrecall.ai) is the commercial distribution of ZettelForge with enterprise extensions enabled. It is offered as managed SaaS by default, with optional self-hosted on-prem and air-gapped deployments for classified environments. Enterprise add-ons:
 
-For teams that want TypeDB-scale graph storage, OpenCTI integration, or multi-tenant deployment, optional extensions are available:
+- **TypeDB STIX 2.1 backend** -- schema-enforced ontology with inference rules
+- **OpenCTI sync** -- bi-directional sync with your OpenCTI instance
+- **Multi-tenant auth** -- OAuth/JWT with per-tenant data isolation
+- **Sigma rule generation** -- detection rules from extracted IOCs (upcoming)
 
-| Extension | What it adds |
-|---|---|
-| TypeDB STIX 2.1 backend | Schema-enforced ontology with inference rules |
-| OpenCTI sync | Bi-directional sync with OpenCTI instances |
-| Multi-tenant auth | OAuth/JWT with per-tenant isolation |
-| Sigma rule generation | Detection rules from extracted IOCs |
+SaaS deploys in minutes with no infrastructure to maintain. Self-hosted ships as a deployable bundle for environments where outbound network egress is restricted or prohibited.
 
-Extensions install separately:
-
-```bash
-pip install zettelforge-enterprise
-```
-
-**Hosted (private beta):** [ThreatRecall](https://threatrecall.ai) is the managed SaaS version of ZettelForge with enterprise extensions enabled. Currently accepting waitlist signups and a limited number of design partners.
+**[Join the waitlist](https://threatrecall.ai)** -- currently onboarding design partners.
 
 ## Configuration
 
@@ -319,17 +351,13 @@ See [CONTRIBUTING.md](CONTRIBUTING.md) for development setup.
 
 ## License
 
-MIT — See [LICENSE](LICENSE).
-
-## About the author
+MIT -- See [LICENSE](LICENSE).
 
-Built by **Patrick Roland** — Director of SOC Services at Summit 7 Systems, where he built the Vigilance MxDR practice from the ground up. Navy nuclear veteran, CISSP, CCP (CMMC 2.0 Professional). [LinkedIn](https://www.linkedin.com/in/patrickgroland/).
+Built by **Patrick Roland** -- [LinkedIn](https://www.linkedin.com/in/patrickgroland/) | Director of SOC Services, Summit 7 Systems | Navy nuclear veteran | CISSP, CCP (CMMC 2.0 Professional)
 
 ## Support the Project
 
-ZettelForge is MIT-licensed. If it's useful in your workflow and you'd like to help keep it maintained:
-
-<a href="https://www.buymeacoffee.com/xypher22pr0" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-green.png" alt="Buy Me a Coffee" style="height: 40px !important;width: 145px !important;" ></a>
+ZettelForge is MIT-licensed. Star the repo, open issues, and submit PRs — all contributions are welcome.
 
 ## Acknowledgments
 
@@ -339,4 +367,3 @@ ZettelForge is MIT-licensed. If it's useful in your workflow and you'd like to h
 - Benchmarked against [LOCOMO](https://snap-research.github.io/locomo/) (ACL 2024) and [CTIBench](https://arxiv.org/abs/2406.07599) (NeurIPS 2024)
 - [LanceDB](https://lancedb.com) | [fastembed](https://github.com/qdrant/fastembed) | [Pydantic](https://pydantic.dev) | [TypeDB](https://typedb.com)
 
-[1]: https://www.microsoft.com/en-us/security/blog/2026/03/20/cti-realm-a-new-benchmark-for-end-to-end-detection-rule-generation-with-ai-agents/