release: SuperLocalMemory 4.0 - #110
Merged
Merged
Conversation
Add server/egress_policy.py, a stateless pre-admission validator that blocks cloud-metadata endpoints (host-normalized, unconditional), validates the full DNS answer set to defeat mixed public/private (rebinding) answers, and fails closed on resolution failure for untrusted callers. _validate_provider_url delegates to it; loopback/LAN dashboard latitude for local model endpoints is preserved. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add core/ingest_policy.py and scrub secrets on the canonical ingest path before content reaches any durable or queryable store. Redaction is unconditional — a credential must never persist verbatim — and independent of the opt-in PII redaction policy. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
get_all_facts and search_facts_fts now filter out archived facts via a NULL-safe predicate, guarded by a cached column-presence check so databases without the archive columns are unaffected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
run_bounded_loop re-checks the budget after each lap's spend and elapsed time, so a lap that overshoots its token or wall-clock budget halts even when its own gate would otherwise pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ties on fused score were left in set-iteration order, which varies with the process hash seed. Fusion now applies a total order (score descending, then fact_id), so identical inputs always produce the same ranking. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Session-date parsing converts explicit offsets to UTC (keeping the +00:00), and the temporal retrieval channel coerces every parsed date to timezone-aware UTC so proximity and interval comparisons never mix naive and aware values. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The pattern extractor's cross-project aggregator implementation lived only under the learning namespace. Re-export it under parameterization so the declared namespace resolves to the same class. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
SLMConfig.load() now captures the full raw JSON dict as a private _raw_preserved attribute. SLMConfig.save() merges that dict back for any key not already covered by explicit field serialization, so unknown forward-compat keys (e.g. vendor extensions) and partially-known nested sections survive a load→save cycle unchanged. Seven scalar fields that load() read but save() never wrote — daemon port, legacy port, idle timeout, enable-legacy-port flag, entity-compilation enabled/boost, and mesh-enabled — are now explicitly serialized, making those settings lossless as well. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…d routes In company mode (RBAC active, require_login enabled), POST/PUT/PATCH/DELETE on adapter process-control endpoints (enable, disable, start, stop) now enforce user-level WRITE permission: - Unauthenticated callers receive 401. - Authenticated viewers (READ-only role) receive 403. - Single-operator installs are unaffected (gate is a no-op when user_count=0). - RBAC state errors fail closed (503), matching the existing read gate. Also extends _SENSITIVE_READ_PREFIXES to cover event stream, agent activity, trust signal, and v3 abstraction/insights routes that were previously excluded from the read authorization check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MCP tools search, list_recent, build_graph, forget, quantize, consolidate_cognitive, get_soft_prompts, get_retention_stats, and run_maintenance no longer accept a caller-supplied profile_id parameter. Each tool now derives the active profile exclusively from the server-side engine state (engine.profile_id / daemon /status), preventing any MCP client from targeting a different tenant's memory by passing an arbitrary profile identifier. Tests updated to assert server-side profile resolution rather than the former caller-override behaviour. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Both the session_init and observe MCP tools were constructing RulesEngine without a config path, causing any persisted deny rules to be silently ignored in favour of in-memory defaults. Pass the canonical config.json path so the engine loads and enforces whatever policy the operator has persisted to disk. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…rofile skill_lineage now adds WHERE profile_id = ? to both the named-skill and all-skills queries so each tenant only sees its own evolution log rows. reinforce_assertion and contradict_assertion scope their SELECT, UPDATE, and DELETE statements to the engine's profile_id, so a caller cannot mutate another tenant's assertion. The check-and-abort happens before any write, ensuring no partial mutation on a cross-profile attempt. core_memory removes the unused profile_id parameter from its MCP signature; the tenant is always resolved server-side from the engine. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…e generated skills
- model_selection: add OpenAI provider support so that when backend is
"openai", model resolution stays within OpenAI models throughout all
pipeline steps (mutation, verify, confirm) — no silent fallback to a
different vendor.
- llm_dispatch: add _call_openai_api_backend and route "openai:" model
ids to it in _pick_backend; add "openai:gpt-4o-mini" to ALLOWED_LLM_MODELS.
- skill_evolver: move EVOLVED_SKILLS_DIR out of ~/.claude into a
dedicated quarantine path so generated skills are isolated from the
active skills tree until explicitly promoted.
- mutation_generator: add semantic deny patterns for unauthorized data
transfer and consent bypass to block exfiltration-style instructions.
- blind_verifier: check negative keywords before positive so that
negating phrases ("cannot approve") are not misparsed as approval.
- test_llm_dispatch: extend registry coverage test to spy the new
OpenAI backend and correct the per-prefix count assertions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The FTS5 trigger fires on every atomic_facts INSERT regardless of the index_external flag, so loop ledger entries — stored via store_fast with index_external=False — are immediately BM25-searchable. Each entry contains the gate query verbatim in its detail field; on lap 2+ the BM25 channel found those self-authored records and the gate falsely passed. The gate closure now filters any recalled result whose fact.content parses as a LedgerEntry (JSON with "run_id" + "lap" keys) before evaluating the pass condition. Only memories written by an external agent can satisfy an independent gate. The top-score computation is rewritten over the filtered result set and _top_score (now unused) is removed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cmd_dashboard resolves --port (or the configured default) then passes it to ensure_daemon so the daemon binds to the user-specified port and the browser URL matches. ensure_daemon gains a keyword-only port parameter (default None, fully backward-compatible). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…gnatures Prewarm and UserPromptSubmit hook now produce the same topic signature when the entity is already named in the prompt text. Entity IDs of the form "category-name" contribute their name part; IDs without a hyphen contribute the full ID. Names already present in content_words are silently deduplicated, so adding recognized entities does not shift the hash and cause cache misses. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
get_fact_event_times restricted results to facts owned by the requesting profile. Global facts (scope='global') belong to a different profile_id and were silently dropped, breaking time-window recall for authorized cross-profile facts. Extend the WHERE clause to also accept rows where scope = 'global', matching the access grant already expressed by get_all_facts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WorkerPool.recall unconditionally serialized fast=None as fast=false, silently overriding the tri-state caller intent. Treat fast consistently with include_global/include_shared: omit the key entirely when None so the worker-side engine resolves the configured default. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The lifespan latched migration_result from before engine.initialize(), so any schema work performed during engine bootstrap was invisible to the health and dashboard endpoints. Add a non-fatal apply_all call immediately after engine.initialize() to capture the current state and update application.state.migration_result before deferred migrations run. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t score A fact with no direct trust row now reads its provenance created_by and inherits the source agent's trust distribution, instead of always returning the uniform prior. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ation off the event loop Import now propagates the portable semantic fields (fact_type, confidence, importance, entities, canonical_entities, referenced_date, pinned) through the ingestion request, and offloads the blocking materialize call to a worker thread so concurrent requests are not stalled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…alidation Temporal invalidation now sets valid_until to the fact's real-world referenced date and system_expired_at to wall-clock time, instead of collapsing both dimensions onto the invalidation timestamp. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
event_stream() now rejects new subscribers once the live connection set reaches its cap, preventing unbounded growth of server-sent-event queues. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…d deletion On correction: temporal_events.description, fact_context, fact_expansion_fts, context cache, BM25 live channel (replace not append), vector store, and ANN index are all brought to the corrected state in one atomic fan-out. On deletion: memories, bm25_tokens, fact_expansion_fts, graph_edges, memory_scenes, fact_context, context cache, BM25 live channel, vector store, and ANN index are all purged before the canonical atomic_facts row is removed. Added update_fact / remove_fact to BM25Channel for in-memory deduplication. Added focused DB helpers: update_temporal_event_description, reset_fact_expansion, delete_bm25_tokens_for_fact, delete_graph_edges_for_fact, remove_fact_from_scenes, delete_memory_for_fact. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…l soft-prompt dependencies Consolidation now forwards the canonical configuration to the skill evolver so automatic evolution honors the enabled flag, and the default soft-prompt pipeline constructs its real dependencies (lazily building the forgetting curve) instead of requiring them to be injected. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Profile erasure now removes the profile's rows from every context-cache database under the data root, so an erased profile leaves no recoverable cached context. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…acts Cognitive consolidation now writes the consolidated replacement fact (indexed and recallable) before archiving its sources, so there is never a window where neither the sources nor the replacement can be recalled. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ing it The daemon lifespan now binds lease release to the exit stack immediately after the lease is claimed and adds a readiness gate that aborts startup (releasing the lease) if a critical step is swallowed, so no live process retains an unusable writer lease. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…s crash-idempotent The migration runner stamps a monotonic schema version after each clean run and refuses to mutate a database whose version exceeds what this build supports, surfacing a downgrade error. Multi-statement migrations now add each column and index idempotently so any committed prefix completes cleanly on restart. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…nifest Backups now copy every store under one shared epoch, checksum each store, and publish an atomic manifest only after re-verification; a store that changes mid-copy fails the whole set without publishing a torn backup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace deleted FastMCP with MCPServer; streamable_http_app takes kwargs (stateless_http/json_response/path/security). Stateless is the default (opt out via SLM_MCP_STATEFUL). Drop idle-timeout EventStore override. App-level session_init/close_session unchanged. Tests rewritten + e2e Client(mode=auto) list+call and pre-init server/discover regressions.
Re-add test_mcp_delete_closes_stateful_transport_streams under SLM_MCP_STATEFUL=1 so DELETE /mcp + Mcp-Session-Id still asserts transport.is_terminated and closed AnyIO streams. coverage_self_check treated every mcp 2.0 read-only tool as a mutator because ToolAnnotations stores read_only_hint (snake_case); dual-read wire + model names so enterprise admission stays correct.
…restage W1: detect lancedb/pycozo via find_spec and lazy-import native backends so availability checks no longer start LanceDBBackgroundEventLoop (Python 3.14 GC segfault race). W2: maintenance closes idle application sessions (bounded, idempotent). W3: register documented prestage_context on MCP with readOnlyHint.
…facts Registering prestage_context (29d32ca) grew full 42->43, power 54->55 and the default _ESSENTIAL_TOOLS 42->43. The profile names encode their sizes (SLM_MCP_PROFILE=full42) and are a user-facing config contract; the published tool-count table depends on them, so full42 must not serve 43 tools. The tool stays REGISTERED and reachable via the whole profile (87) — the unreachable-tool defect remains fixed — but is absent from the counted sets. Tests now assert the size contract directly so this cannot regress silently. Also npmignore graphify-out/, .gitnexus/ and .graphify_* code-intelligence output so repository structure is never published.
EmbeddingService._readline_with_timeout (and the same helper in WorkerPool, CrossEncoderReranker, and the doctor probe) spawned a daemon thread per read and returned on join timeout while the thread stayed blocked in stream.readline(), leaking one thread and pinning the pipe FD per hung worker response. Prefer a deadline-driven selectors poll of the stream fileno on POSIX so timeouts never leave a reader thread behind. Keep the thread path only for fileno-less mocks and Windows pipes. Add a deterministic regression that induces N pipe timeouts and asserts zero new _read threads.
Remove EU AI Act compliance claims from MCP set_mode/_mode_description. Derive dashboard locality labels from mode records (Mode C never local-only). Resolve daemon learning.db via configured base_dir (single path with engine). Raise EmbeddingMigrationAborted on failed migration (distinct from no-op 0). Close fileno-less readline timeout streams so reader threads cannot leak.
Move F-03 locality fields into the real /api/v3/dashboard handler and drop the unified_daemon startup monkeypatch. Add route-level tests that fail when the field is not served.
The reliability evidence suite lived in a separate repository (~/SLMv4/paper-and-research/experiments) that this repo's CI never ran. That made published results silently perishable: commit f6e402b added required schema (M033/M037), updated the in-repo tests for it, and could not update the paper's exp7 -- so exp7 went from 200/200 to 0/200 on a formal invariant the paper cites, with every in-repo test still green. See F-16. Evidence now ships with the code it measures: - benchmark/ : the ten experiments, _harness.py, run_all.py, bench_perf.py and the committed results/ artifacts, including Muse's F-06 fix that wires the two previously orphaned scripts (exp2b, exp_governed_latency) into run_all. - tests/test_benchmark_suite_reachability.py : asserts every exp*.py on disk is BOTH imported by and invoked from run_all.py, decided on the AST only. - tests/test_benchmark_trial_distribution.py : asserts provenance metadata is computed from n rather than a literal. The gates live in tests/ deliberately: pyproject sets testpaths = ["tests"], so a gate placed in benchmark/ would never be collected and would stop guarding anything without anyone noticing. Both gates were verified red-then-green, and the reachability gate was additionally proven to reject a comment-only mention and an imported-but-never-called module -- its earlier substring-based form passed both, which made it no gate at all. Absolute home paths were removed from the migrated tests; this tree is published. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
.pytest_tmp_data/config.json was tracked and embedded an absolute home path, disclosing the username and working-tree layout in a repository that is about to be published. It also named `superlocalmemory` rather than `superlocalmemory-v4`, so it was stale state carried over from the V3 tree. .gitignore already listed `.pytest_tmp_data/` -- and that is precisely why this survived. An ignore rule governs files git is not yet tracking; it never untracks a file already in the index. The rule was inert from the day the file was committed. - git rm --cached .pytest_tmp_data/config.json (no history rewrite: the file holds no secret, every api_key field is empty) - tests/test_repo_hygiene.py: two gates asserting on the INDEX, not on .gitignore -- no tracked blob may contain an absolute home path, and no machine-local scratch directory may be tracked. The gates query git directly rather than reading the working tree. The first version walked `git ls-files` and called Path.read_text() with `except OSError: continue`. This repo's conftest redirects HOME into a per-run sandbox; under it the read raised, the continue swallowed it, every file was skipped, and the gate reported PASS with the tracked offender still present. A gate that cannot inspect its inputs must fail, never silently skip. Both gates were verified to fire on the real defect and pass once it is removed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… (F-16/17/18) F-16 (P0) — exp7_generation_fence returned 0/200 at HEAD while the committed artifact claimed 200/200. exp7 backs thm:fence, one of the five formal invariants the paper cites. Root cause, found by `git bisect run` over the 78 commits since 2026-08-02: commit f6e402b ("tamper-evident HMAC manifest + unified erasure orchestrator") added required schema and updated the in-repo tests to apply M033. The evidence suite lived in a separate repository at the time and could not be updated, so exp7 kept hand-picking M018 + M032 only. The canonical write path then failed with WriteCoordinatorError('canonical write command failed'), surfaced as a generic CanonicalRememberUnavailable on the POSITIVE control -- every trial. Every in-repo test stayed green throughout. Ruled out by direct test, not inference: not the agent fixes (identical at 172464d), not a wrong-package import (editable install verified via __file__), not writer-lease contention (reproduced with the production daemon stopped), not data-root contention (reproduced with an isolated SLM_DATA_DIR). exp7 now drives the real migration runner instead of naming modules by hand, so a future schema requirement is picked up automatically. Hand-picked migrations are a snapshot of a schema that keeps moving; that is what caused this. Verified: 200/200 at HEAD. F-17 (P1) — exp7 had no argparse at all. It ignored --trials and --output-dir, always ran 200 trials, and always wrote to the committed results/exp7_generation_fence.json. During the audit that silently overwrote published evidence (restored from git). It now takes the same CLI contract as the rest of the suite. Verified: --trials 6 yields 6/6 into an isolated directory, with benchmark/results/ untouched. F-18 (P2) — the SLM_SOURCE_ROOT guard existed in exp2b and not in exp7, so two experiments in one bundle could measure different builds. The guard now lives in _harness.py and applies uniformly; the copy-pasted version is gone. tests/test_benchmark_drift_guard.py is the point of the change: it decides on the AST that no experiment hand-enumerates migration modules (files discovered from disk, so an eleventh experiment cannot slip past), and smoke-runs exp7 asserting a non-zero hold rate -- so the next schema change turns CI red here instead of producing 0/200 in a reviewer's terminal. Gate verified by re-injecting the exact defect: the drift guard fails on a hand-picked migration import and passes once removed. 26 invariant assertions green across all nine gate files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… (F-11/F-13)
F-11 — docs/audits/V4_RELEASE_REMEDIATION_PLAN_2026-08-05.md was tracked and so
would publish with the repo. It is an internal, dated process artifact: it names
internal commit SHAs, enumerates in plain language what was broken pre-release,
and carries point-in-time gate claims ("Full selected Python suite: 8,730
passed", "GitNexus staged impact: medium risk") that go stale on the next
commit. Two of its runtime blockers -- mode-derived EU AI Act verdicts and the
unconditional LOCAL ONLY dashboard label -- were still open in the code it would
have shipped beside, which turns a defect into self-documented non-compliance.
Both are now fixed (29133ec, cc9f87b), but re-verifying twelve dated claims to
publish a document that expires on the next commit is a bad trade. Untracked and
preserved in the private launch folder; docs/audits/ added to .gitignore. The
public record of shipped work is CHANGELOG.md, which does not go stale.
The other 49 files under docs/ remain public.
F-13 — docs/security/dependency-audit-exceptions.md stays public: naming an
advisory, proving the vulnerable API is unreachable from untrusted input, and
committing to a removal condition is worth more to a reader than silence. But
its entries had stopped being true. Verified against the PyPI JSON API on
2026-08-08:
NLTK doc: "no stable fixed version, 3.10.0-rc1 not auditable" -> 3.10.2 stable
setuptools doc: "removed with the PyTorch 2.13 upgrade" -> 83.0.0 stable
PyTorch doc: "why 2.13.0 is not accepted" -> 2.13.0 stable
All three removal conditions are met upstream; the remaining work is ours.
The PyTorch deferral rationale is withdrawn outright. It blamed a 6,000-test
segfault "during garbage collection at 96%" on the native/ML upgrade. That crash
is now root-caused: the faulthandler C stack names _pydantic_core called by
CPython's gc_collect_main, measured at ~22% of full runs, reproducing on Python
3.12.13 and 3.14.5, and occurring on the current stack with PyTorch 2.11 still
pinned. It is an upstream pydantic-core defect and staying on 2.11 does not
avoid it. Gating a security upgrade on an unrelated upstream crash is the wrong
trade. Review deadlines moved 2026-08-20 -> 2026-09-05 with the reason stated.
The non-reachability arguments are unchanged; they are why these are exceptions
rather than incidents.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
… gaps (F-22/F-23/F-24)
Bundle regenerated from v4-impl at n=200: 12 artifacts, every experiment
200/200, aggregate 2,200/2,200. exp2b and exp_governed_latency now produce
committed artifacts for the first time. Governed latency re-measured at n=1000
because at n=200 the p99 inverted (bypass slower than governed), which is
physically implausible tail noise a reviewer would rightly attack.
F-22 — tests/test_benchmark_suite_reachability.py globbed `exp*.py`, so it never
covered bench_perf.py, which is orphaned from run_all.py and yet produces
bench_perf.json: the sole evidence for the paper's entire Real-Scale Performance
section. A gate written around a naming convention only guards files that follow
it. It now globs every benchmark module and requires anything unreachable to be
declared in _MANUAL_RUN with a stated reason (bench_perf needs a retained ~1 GB
store and cannot run in a fresh-temp bundle).
F-23 — three genuine identity leaks in a repository about to be published:
* bench_perf.py hardcoded a per-session scratchpad path as its default DB
reference. That leaked a home directory AND made the benchmark unrunnable by
anyone else, since the path no longer existed even locally. Now driven by
SLM_BENCH_DB / SLM_BENCH_DIR with --db required when unset.
* exp2b and exp_governed_latency recorded absolute slm_module_file paths into
their artifacts. Both now record a repo-relative path; existing artifacts
relativised.
* a test sentinel used a real name; replaced with a placeholder.
The hygiene gate itself was rewritten twice. Matching one spelling of one name
missed the flattened "-Users-<author>-" form. Matching every home-directory
shape then flagged 23 files that were legitimate documentation showing
/Users/yourusername/. It now matches the shape and judges the segment against a
placeholder set, so it catches real identities without crying wolf -- a gate
that cries wolf gets deleted by whoever hits it next.
This is the fourth fail-open gate found in this session. Every one failed the
same way: written around the instance that was found rather than the class it
belongs to.
26 invariant assertions green across nine gate files.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Elevate SLM-Mesh on the README front door, correct Modes A/B/C vs EU AI Act compliance language, and update allowlisted docs/wiki product identity from SuperLocalMemory V3 to V4 without inventing capabilities or touching version pins in packaging files.
"Rent the LLM. Own the memory." Models are interchangeable and rented by the token; what agents remember is the customer's data, the retention obligation and the audit trail. That layer is the one worth owning, and it is the layer this project governs. Reframes the front door around the gap rather than the feature list: - EU AI Act Annex III obligations took effect 2026-08-02 — tamper-evident logs, traceability to model/prompt/policy/owner, reconstructable state, and a compliance boundary that extends to every agent in a chain (Recitals 99-100). - The right to erasure reaches into agent memory, embeddings and logs, not just database rows. Most memory layers were built for retrieval quality and were never asked these questions. Adds the verification invitation to the front door: every guarantee is a falsifiable invariant tested with a negative control, and the harness that regenerates the evidence ships with the source (`python benchmark/run_all.py --trials 200 --output-dir results/`), including a statement of what each experiment does NOT exercise. Positioning is gap-filling, not comparative: no competitor is named and no superiority claim is made. Compliance is never derived from operating mode -- mode determines technical locality, not legal classification (src/superlocalmemory/core/modes.py). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Integrates the V4 implementation with the complete main hotfix history without rewriting main.\n\nVerified locally before opening:\n- 8,995 tests passed; 36 skipped; 0 failed\n- V4 evidence bundle: 2,200/2,200 scoped repetitions\n- final security review: PASS\n- final code review: PASS\n- wheel, sdist, and npm package built\n- clean wheel install: version 4.0.0, schema 39\n- npm production audit: 0 vulnerabilities\n\nThe merge commit has both v4-impl and the current main tip as parents; no main commit is missing.