pyproject.toml

[build-system]
requires = ["hatchling>=1.25"]
build-backend = "hatchling.build"

[project]
name = "ghost-memory"
version = "0.1.0"
description = "ECHOFORM — LLM memory substrate via FHRR side-channel + residual-stream bias adapter, with cryptographic forgetting certificates."
readme = "README.md"
license = { file = "LICENSE" }
requires-python = ">=3.11,<3.13"
authors = [{ name = "ECHOFORM Contributors" }]
keywords = ["llm", "memory", "vsa", "fhrr", "hyperdimensional-computing", "gdpr"]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Operating System :: POSIX :: Linux",
    "Operating System :: MacOS :: MacOS X",
    "Operating System :: Microsoft :: Windows",
    "Topic :: Scientific/Engineering :: Artificial Intelligence",
]

# Pinned dependencies — exact versions from ADR §1.
dependencies = [
    # Web
    "fastapi==0.136.1",
    "uvicorn[standard]==0.32.1",
    "pydantic==2.9.2",
    "pydantic-settings==2.5.2",
    "httpx==0.27.2",
    "tenacity==9.0.0",
    "slowapi==0.1.9",
    "asgi-correlation-id==4.3.4",

    # Numerics / ML (CPU-friendly versions for smoke; CUDA install in Dockerfile.worker)
    "numpy==2.1.3",
    "scipy==1.14.1",

    # Storage
    "asyncpg==0.30.0",
    "sqlalchemy==2.0.36",
    "alembic==1.13.3",
    "boto3==1.35.45",
    "redis==5.0.8",
    "cachetools==5.5.0",

    # Security
    # NOTE: cryptography bumped 43.0.3 → 46.0.7 to clear four disclosed CVEs:
    #   CVE-2024-12797 (fix 44.0.1) — TLS verification bypass
    #   CVE-2026-26007 (fix 46.0.5)
    #   CVE-2026-34073 (fix 46.0.6)
    #   CVE-2026-39892 (fix 46.0.7) — disclosed after 46.0.6 shipped
    # The cryptography release cadence is faster than build cycles —
    # Dependabot is configured to auto-PR security patches.
    "cryptography==46.0.7",
    "pyjwt[crypto]>=2.12,<3",
    "python-ulid==3.0.0",

    # Observability
    "opentelemetry-sdk==1.41.1",
    "opentelemetry-exporter-otlp==1.41.1",
    "opentelemetry-instrumentation-fastapi==0.62b1",
    "opentelemetry-instrumentation-asyncpg==0.62b1",
    "opentelemetry-instrumentation-httpx==0.62b1",
    "opentelemetry-instrumentation-redis==0.62b1",
    "prometheus-client==0.21.0",
    "structlog==25.5.0",

    # Safety (PII)
    # NOTE: presidio-* are heavy and pull spaCy; they are listed as optional
    # under [project.optional-dependencies].safety so the smoke wheel stays light.

    # Serialization (adapter weights)
    "safetensors==0.4.5",

    # CLI
    "typer==0.15.1",
    "rich==14.0.0",
]

[project.optional-dependencies]
gpu = [
    "torch==2.6.0+cu124",
    "mamba-ssm==2.3.2.post1",
    "causal-conv1d==1.4.0",
    "transformers==4.46.3",
    "accelerate==1.0.1",
    "triton==3.2.0",
    "torch-hd==5.8.4",
]
safety = [
    "presidio-analyzer==2.2.355",
    "presidio-anonymizer==2.2.355",
    "spacy==3.7.5",
]
all = ["ghost-memory[gpu,safety]"]

[dependency-groups]
dev = [
    "pytest==8.3.3",
    "pytest-asyncio==0.24.0",
    "pytest-httpx==0.32.0",
    "pytest-benchmark==4.0.0",
    "hypothesis==6.114.0",
    "testcontainers[postgres,redis,minio]==4.8.2",
    "coverage[toml]==7.6.4",
    "ruff==0.7.1",
    "mypy==1.13.0",
    "pip-licenses==5.0.0",
    "pip-audit>=2.7,<3",
    "locust==2.31.5",
    "import-linter>=2.0,<3",
]
docs = [
    "mkdocs>=1.6,<2",
    "mkdocs-material>=9.5,<10",
    "mkdocstrings[python]>=0.26,<1",
]

[project.scripts]
echoform = "echoform.cli:app"
ghost-memory = "echoform.cli:app"

[project.urls]
Homepage = "https://github.com/OpenAgentic-Labs/echoform-ghost-memory"
Documentation = "https://openagentic-labs.github.io/echoform-ghost-memory"
Issues = "https://github.com/OpenAgentic-Labs/echoform-ghost-memory/issues"
Changelog = "https://github.com/OpenAgentic-Labs/echoform-ghost-memory/blob/main/CHANGELOG.md"

# ── Build configuration ───────────────────────────────────────────────────────

[tool.hatch.build.targets.wheel]
packages = ["echoform", "ghost_memory"]

[tool.hatch.build.targets.sdist]
include = ["echoform/**", "ghost_memory/**", "README.md", "LICENSE", "CHANGELOG.md", "tests/**"]

# ── Tool config ───────────────────────────────────────────────────────────────

[tool.ruff]
line-length = 100
target-version = "py311"
extend-exclude = ["echoform/storage/episodic/migrations/versions"]

[tool.ruff.lint]
select = ["E", "F", "I", "B", "UP", "SIM", "PT", "RUF"]
# RUF001/002/003: legitimate Unicode math characters in scientific docstrings
# (β, Φ, ≈, − …). Globally ignored — the codebase is math-dense by design.
ignore = ["E501", "B008", "RUF012", "RUF001", "RUF002", "RUF003"]

[tool.ruff.lint.per-file-ignores]
# B017: tests/unit/test_types.py asserts that frozen dataclasses raise on
# assignment; the exact exception class is irrelevant — the contract is
# "raises something." Narrowing per-test would harm readability without
# improving correctness.
"tests/**" = ["B011", "PT011", "B017"]
"echoform/types.py" = ["UP007"]  # PEP-604 vs typing.Optional readability

[tool.mypy]
python_version = "3.11"
strict = false
ignore_missing_imports = true
warn_unused_ignores = true
warn_redundant_casts = true

[[tool.mypy.overrides]]
module = ["echoform.types", "echoform.core.fhrr.*", "echoform.security.*", "echoform.safety.*"]
strict = true

[tool.pytest.ini_options]
minversion = "8.0"
testpaths = ["tests"]
asyncio_mode = "auto"
addopts = "-ra --strict-markers --strict-config -p no:cacheprovider"
markers = [
    "smoke: smoke value-path tests",
    "integration: requires running postgres/redis",
    "security: security regression tests",
    "perf: performance / benchmark tests (slow)",
]
filterwarnings = [
    "ignore::DeprecationWarning",
]

[tool.coverage.run]
branch = true
source = ["echoform"]
omit = ["echoform/storage/episodic/migrations/**", "*/__main__.py"]

[tool.coverage.report]
exclude_also = ["if TYPE_CHECKING:", "raise NotImplementedError", "pragma: no cover"]
fail_under = 80

[tool.coverage.html]
directory = "htmlcov"