Commit graph

234 commits

Author SHA1 Message Date
Jeremie Fraeys
5f2fc66200
fix(ci): correct Zig download URLs to ziglang.org format
Some checks failed
CI with Native Libraries / Build and Test Native Libraries (push) Blocked by required conditions
CI with Native Libraries / Build Release Libraries (push) Blocked by required conditions
Documentation / build-and-publish (push) Waiting to run
Security Scan / Security Analysis (push) Waiting to run
Security Scan / Native Library Security (push) Waiting to run
Checkout test / test (push) Successful in 5s
CI with Native Libraries / Check Build Environment (push) Successful in 18s
CI/CD Pipeline / Test (push) Failing after 1m9s
CI/CD Pipeline / Dev Compose Smoke Test (push) Has been skipped
CI/CD Pipeline / Build (push) Has been skipped
CI/CD Pipeline / Test Scripts (push) Has been skipped
CI/CD Pipeline / Security Scan (push) Has been cancelled
CI/CD Pipeline / Docker Build (push) Has been cancelled
Change from incorrect GitHub releases URL to official ziglang.org URL

Format: ziglang.org/download/{VERSION}/zig-{ARCH}-{OS}-{VERSION}.tar.xz
2026-02-21 20:39:18 -05:00
Jeremie Fraeys
f9e80f8bdf
ci: remove all caching from CI workflow
Some checks failed
CI with Native Libraries / Build and Test Native Libraries (push) Blocked by required conditions
CI with Native Libraries / Build Release Libraries (push) Blocked by required conditions
Documentation / build-and-publish (push) Waiting to run
Security Scan / Security Analysis (push) Waiting to run
Security Scan / Native Library Security (push) Waiting to run
Checkout test / test (push) Successful in 6s
CI with Native Libraries / Check Build Environment (push) Successful in 12s
CI/CD Pipeline / Test (push) Failing after 21s
CI/CD Pipeline / Dev Compose Smoke Test (push) Has been skipped
CI/CD Pipeline / Build (push) Has been skipped
CI/CD Pipeline / Test Scripts (push) Has been skipped
CI/CD Pipeline / Security Scan (push) Has been cancelled
CI/CD Pipeline / Docker Build (push) Has been cancelled
Cache infrastructure is not implemented in the Forgejo instance, causing timeouts

Removed:

- actions/cache steps for Go modules, Zig build, native libs, apt packages

- Docker buildx layer caching (cache-from/cache-to)
2026-02-21 20:37:51 -05:00
Jeremie Fraeys
169dd98642
fix(ci): use GitHub releases for Zig download with better error handling
Some checks failed
CI with Native Libraries / Build Release Libraries (push) Blocked by required conditions
Security Scan / Security Analysis (push) Waiting to run
Security Scan / Native Library Security (push) Waiting to run
Checkout test / test (push) Successful in 4s
CI with Native Libraries / Check Build Environment (push) Successful in 11s
CI/CD Pipeline / Test (push) Failing after 5m7s
CI/CD Pipeline / Dev Compose Smoke Test (push) Has been skipped
CI/CD Pipeline / Build (push) Has been skipped
CI/CD Pipeline / Test Scripts (push) Has been skipped
CI/CD Pipeline / Security Scan (push) Failing after 4m50s
Documentation / build-and-publish (push) Failing after 26s
CI with Native Libraries / Build and Test Native Libraries (push) Failing after 2h5m54s
CI/CD Pipeline / Docker Build (push) Has been skipped
- Switch from ziglang.org/download to github.com/ziglang/zig/releases

- Add curl -fsSL --retry 3 for reliable downloads

- Use file-based extraction instead of pipe-to-tar for verification
2026-02-21 18:18:54 -05:00
Jeremie Fraeys
ed7b5032a9
build: update Makefile and TUI controller integration
Some checks failed
Build CLI with Embedded SQLite / build (arm64, aarch64-linux) (push) Waiting to run
Build CLI with Embedded SQLite / build (x86_64, x86_64-linux) (push) Waiting to run
Build CLI with Embedded SQLite / build-macos (arm64) (push) Waiting to run
Build CLI with Embedded SQLite / build-macos (x86_64) (push) Waiting to run
CI/CD Pipeline / Docker Build (push) Blocked by required conditions
Security Scan / Security Analysis (push) Waiting to run
Security Scan / Native Library Security (push) Waiting to run
Checkout test / test (push) Successful in 6s
CI with Native Libraries / Check Build Environment (push) Successful in 12s
CI/CD Pipeline / Test (push) Failing after 5m15s
CI/CD Pipeline / Dev Compose Smoke Test (push) Has been skipped
CI/CD Pipeline / Build (push) Has been skipped
CI/CD Pipeline / Test Scripts (push) Has been skipped
CI/CD Pipeline / Security Scan (push) Failing after 4m49s
Contract Tests / Spec Drift Detection (push) Failing after 13s
Contract Tests / API Contract Tests (push) Has been skipped
Deploy API Docs / Build API Documentation (push) Failing after 36s
Deploy API Docs / Deploy to GitHub Pages (push) Has been skipped
Documentation / build-and-publish (push) Failing after 26s
CI with Native Libraries / Build and Test Native Libraries (push) Has been cancelled
CI with Native Libraries / Build Release Libraries (push) Has been cancelled
2026-02-21 18:00:09 -05:00
Jeremie Fraeys
be39b37aec
feat: native GPU detection and NVML bridge for macOS and Linux
- Add dynamic NVML loading for Linux GPU detection
- Add macOS GPU detection via IOKit framework
- Add Zig NVML wrapper for cross-platform GPU queries
- Update native bridge to support platform-specific GPU libs
- Add CMake support for NVML dynamic library
2026-02-21 17:59:59 -05:00
Jeremie Fraeys
1a1844e9e9
fix(cli): remaining ArrayList API fixes in dataset and queue commands 2026-02-21 17:59:51 -05:00
Jeremie Fraeys
b1c9bc97fc
fix(cli): CLI structure, manifest, and asset fixes
- Fix commands.zig imports (logs.zig → log.zig, remove missing modules)
- Fix manifest.writeManifest to accept allocator param
- Add db.Stmt type alias for sqlite3_stmt
- Fix rsync placeholder to be valid shell script (#!/bin/sh)
2026-02-21 17:59:20 -05:00
Jeremie Fraeys
382c67edfc
fix(cli): WebSocket protocol and sync command fixes
- Add sendSyncRun method for run synchronization
- Add sendRerunRequest method for queue rerun
- Add sync_run (0x26) and rerun_request (0x27) opcodes
- Fix protocol import path to relative path
- Fix db.Stmt type alias usage in sync.zig
2026-02-21 17:59:14 -05:00
Jeremie Fraeys
ccd1dd7a4d
fix(cli): Zig 0.15 core API changes
- ArrayList: .init(allocator) → .empty, add allocator param to append/deinit/toOwnedSlice
- Atomic: std.atomic.Atomic → std.atomic.Value, lowercase order names (.seq_cst)
- Process: execvp instead of execvpe, inline wait status macros for macOS
- Time: std.time.sleep → std.Thread.sleep
- Error handling: fix isProcessRunning error union comparison
2026-02-21 17:59:05 -05:00
Jeremie Fraeys
20fde4f79d
feat: integrate NVML GPU monitoring into TUI
- Update TUI controller loadGPU() to use NVML when available
- Prioritize NVML over nvidia-smi command for better performance
- Show additional metrics: power draw, SM clock when available
- Maintain fallback to nvidia-smi and system_profiler
2026-02-21 15:17:22 -05:00
Jeremie Fraeys
c56e53cb52
fix: NVML stub support for systems without NVIDIA drivers
- Add stub implementation in nvml_gpu.cpp when NVML not available
- CMakeLists.txt checks for both NVML library and headers
- Build succeeds on macOS/non-NVIDIA systems with stub
- Runtime detection via gpu_is_available() prevents runtime errors
2026-02-21 15:16:54 -05:00
Jeremie Fraeys
05b7af6991
feat: implement NVML-based GPU monitoring
- Add native/nvml_gpu/ C++ library wrapping NVIDIA Management Library
- Add Go bindings in internal/worker/gpu_nvml_native.go and gpu_nvml_stub.go
- Update gpu_detector.go to use NVML for accurate GPU count detection
- Update native/CMakeLists.txt to build nvml_gpu library
- Provides real-time GPU utilization, memory, temperature, clocks, power
- Falls back to environment variable when NVML unavailable
2026-02-21 15:16:09 -05:00
Jeremie Fraeys
d6265df0bd
docs: update all documentation to use build tags instead of deprecated env var
- README.md: Replace FETCHML_NATIVE_LIBS with -tags native_libs
- docs/src/native-libraries.md: Update all examples to use build tags
- .forgejo/workflows/ci-native.yml: Use -tags native_libs in all test steps
- Remove deprecated FETCHML_NATIVE_LIBS=1/0 env var references
2026-02-21 15:11:27 -05:00
Jeremie Fraeys
e557313e08
fix: context reuse benchmark uses temp directory
- Replace hardcoded testdata path with b.TempDir()
- Add createSmallDataset helper for self-contained benchmarks
- Fixes FAIL: BenchmarkContextReuse / BenchmarkSequentialHashes
2026-02-21 14:38:00 -05:00
Jeremie Fraeys
5f8e7c59a5
fix: resolve undefined DirOverallSHA256HexParallel in benchmark files
- Replace worker.DirOverallSHA256HexParallel with worker.DirOverallSHA256Hex
- Fixes in dataset_hash_bench_test.go and hash_bench_test.go
- All benchmarks pass with native_libs build tag
2026-02-21 14:30:22 -05:00
Jeremie Fraeys
fa383ebc6f
fix: benchmark function name and verify native context reuse 2026-02-21 14:28:04 -05:00
Jeremie Fraeys
158c525bef
fix: resolve benchmark and build tag conflicts
- Remove duplicate hash_selector.go (build tags handle switching)
- Fix benchmark to use worker.DirOverallSHA256Hex
- Fix snapshot_store.go to use integrity.DirOverallSHA256Hex directly
- Native tests pass, benchmarks now correctly test native vs Go
2026-02-21 14:26:48 -05:00
Jeremie Fraeys
90d702823b
fix: correct C type cast and add context reuse benchmark
- Fix C.uint32_t cast for runtime.NumCPU() in native_bridge_libs.go
- Add context_reuse_bench_test.go to verify performance gains
- All native tests pass (8/8)
- Benchmarks functional
2026-02-21 14:20:40 -05:00
Jeremie Fraeys
d1ac558107
perf: implement context reuse
Go Worker (internal/worker/native_bridge_libs.go):
- Add global hashCtx with sync.Once for lazy initialization
- Eliminates 5-20ms fh_init/fh_cleanup per hash operation
- Uses runtime.NumCPU() for optimal thread count
- Log initialization time for observability

Zig CLI (cli/src/native/hash.zig):
- Add global_ctx with atomic flag and mutex
- Thread-safe initialization with double-check pattern
- Idempotent init() callable from multiple threads
- Log init time for debugging
2026-02-21 14:19:14 -05:00
Jeremie Fraeys
48d00b8322
feat: integrate native queue backend into worker and API
- Add QueueBackendNative constant to backend.go
- Add case for native queue in NewBackend() switch
- Native queue uses same FilesystemPath config
- Build tag -tags native_libs enables native implementation

Native library integration now complete:
- dataset_hash: Worker (hash_selector), CLI (verify auto-hash)
- queue_index: Worker/API (backend selection with 'native' type)
2026-02-21 14:11:10 -05:00
Jeremie Fraeys
25ae791b5c
refactor: make dataset hash automatic in verify command
- Remove separate 'hash' subcommand
- Integrate native SHA256 hash into 'dataset verify'
- Hash is now computed automatically when verifying datasets
- Shows hash in output (JSON, CSV, and text formats)
- Help text updated to indicate auto-hashing
2026-02-21 14:09:44 -05:00
Jeremie Fraeys
1a35c54300
feat: integrate native library into Zig CLI
- Add cli/src/native/hash.zig - C ABI wrapper for dataset_hash
- Update cli/src/commands/dataset.zig - Add 'hash' subcommand
- Update cli/build.zig - Link against libdataset_hash.so
- Fix pre-existing CLI errors in experiment.zig (errorMsg signatures, columnInt64)

Usage: ml dataset hash <path>

Note: Additional pre-existing CLI errors remain in sync.zig
2026-02-21 14:08:07 -05:00
Jeremie Fraeys
4b2ee75072
chore: move test-native-with-redis.sh to scripts/testing/ 2026-02-21 13:58:19 -05:00
Jeremie Fraeys
c89d970210
refactor: migrate from env var to build tags for native libs
Replace FETCHML_NATIVE_LIBS=1 environment variable with -tags native_libs:

Changes:
- internal/queue/native_queue.go: UseNativeQueue is now const true
- internal/queue/native_queue_stub.go: UseNativeQueue is now const false
- build/docker/simple.Dockerfile: Add -tags native_libs to go build
- deployments/docker-compose.dev.yml: Remove FETCHML_NATIVE_LIBS env var
- native/README.md: Update documentation for build tags
- scripts/test-native-with-redis.sh: New test script with Redis via docker-compose

Benefits:
- Compile-time enforcement (no runtime checks needed)
- Cleaner deployment (no env var management)
- Type safety (const vs var)
- Simpler testing with docker-compose Redis integration
2026-02-21 13:43:58 -05:00
Jeremie Fraeys
472590f831
docs: expand Research Trustworthiness section with detailed design rationale
Add comprehensive explanation of the reproducibility problem and fix:
- Document readdir filesystem-dependent ordering issue
- Explain std::sort fix for lexicographic ordering
- Clarify recursive traversal with cycle detection
- Document hidden file and special file exclusions
- Warn researchers about silent omissions and empty hash edge cases

This addresses the core concern that researchers need to understand
the hash is computed over sorted paths to trust cross-machine verification.
2026-02-21 13:38:25 -05:00
Jeremie Fraeys
7efe8bbfbf
native: security hardening, research trustworthiness, and CVE mitigations
Security Fixes:
- CVE-2024-45339: Add O_EXCL flag to temp file creation in storage_write_entries()
  Prevents symlink attacks on predictable .tmp file paths
- CVE-2025-47290: Use openat_nofollow() in storage_open()
  Closes TOCTOU race condition via path_sanitizer infrastructure
- CVE-2025-0838: Add MAX_BATCH_SIZE=10000 to add_tasks()
  Prevents integer overflow in batch operations

Research Trustworthiness (dataset_hash):
- Deterministic file ordering: std::sort after collect_files()
- Recursive directory traversal: depth-limited with cycle detection
- Documented exclusions: hidden files and special files noted in API

Bug Fixes:
- R1: storage_init path validation for non-existent directories
- R2: safe_strncpy return value check before strcat
- R3: parallel_hash 256-file cap replaced with std::vector
- R4: wire qi_compact_index/qi_rebuild_index stubs
- R5: CompletionLatch race condition fix (hold mutex during decrement)
- R6: ARMv8 SHA256 transform fix (save abcd_pre before vsha256hq_u32)
- R7: fuzz_index_storage header format fix
- R8: enforce null termination in add_tasks/update_tasks
- R9: use 64 bytes (not 65) in combined hash to exclude null terminator
- R10: status field persistence in save()

New Tests:
- test_recursive_dataset.cpp: Verify deterministic recursive hashing
- test_storage_symlink_resistance.cpp: Verify CVE-2024-45339 fix
- test_queue_index_batch_limit.cpp: Verify CVE-2025-0838 fix
- test_sha256_arm_kat.cpp: ARMv8 known-answer tests
- test_storage_init_new_dir.cpp: F1 verification
- test_parallel_hash_large_dir.cpp: F3 verification
- test_queue_index_compact.cpp: F4 verification

All 8 native tests passing. Library ready for research lab deployment.
2026-02-21 13:33:45 -05:00
Jeremie Fraeys
201cb66f56
fix(cli): Standardize WebSocket client imports
- Change from deps.zig indirect imports to direct @import() calls
- Improves build compatibility and clarity
- Aligns with Zig idiomatic import style
2026-02-20 21:41:51 -05:00
Jeremie Fraeys
a3b957dcc0
refactor(cli): Update build system and core infrastructure
- Makefile: Update build targets for native library integration
- build.zig: Add SQLite linking and native hash library support
- scripts/build_rsync.sh: Update rsync embedded binary build process
- scripts/build_sqlite.sh: Add SQLite constants generation script
- src/assets/README.md: Document embedded asset structure
- src/utils/rsync_embedded_binary.zig: Update for new build layout
2026-02-20 21:39:51 -05:00
Jeremie Fraeys
04ac745b01
refactor(cli): Rename note to annotate and re-add experiment command
- Renamed note.zig to annotate.zig (preserves user's preferred naming)
- Updated all references from 'ml note' to 'ml annotate'
- Re-added experiment.zig with create/list/show subcommands
- Updated main.zig dispatch: 'a' for annotate, 'e' for experiment
- Updated printUsage and test block to reflect changes
2026-02-20 21:32:01 -05:00
Jeremie Fraeys
7c4a59012b
feat(tui): Add SQLite support for local mode
- store/store.go: New SQLite storage for TUI local mode
  - Open() with WAL mode and NORMAL synchronous
  - Schema initialization for ml_experiments, ml_runs, ml_metrics, ml_params, ml_tags
  - GetUnsyncedRuns(), GetRunsByExperiment(), MarkRunSynced()
  - GetRunMetrics(), GetRunParams() for run details
- config/config.go: Add local mode configuration fields
  - DBPath, ForceLocal, ProjectRoot fields
  - Experiment struct with Name and Entrypoint
  - IsLocalMode() and GetDBPath() helper methods
- go.mod: Add modernc.org/sqlite v1.36.0 dependency
2026-02-20 21:28:49 -05:00
Jeremie Fraeys
adf4c2a834
refactor(cli): Update main.zig and remove deprecated commands
- main.zig: Update command dispatch and usage text
  - Wire up new commands: note, logs, sync, cancel, watch
  - Remove deprecated command references
  - Updated usage reflects unified command structure
- Delete deprecated command files:
  - annotate.zig (replaced by note.zig)
  - experiment.zig (functionality in run/note/logs)
  - logs.zig (old version, replaced)
  - monitor.zig (unused)
  - narrative.zig (replaced by note --hypothesis/context)
  - outcome.zig (replaced by note --outcome)
  - privacy.zig (replaced by note --privacy)
  - requeue.zig (functionality merged into queue --rerun)
2026-02-20 21:28:42 -05:00
Jeremie Fraeys
d3461cd07f
feat(cli): Update server integration commands
- queue.zig: Add --rerun <run_id> flag to re-queue completed local runs
  - Requires server connection, rejects in offline mode with clear error
  - HandleRerun function sends rerun request via WebSocket
- sync.zig: Rewrite for WebSocket experiment sync protocol
  - Queries unsynced runs from SQLite ml_runs table
  - Builds sync JSON with metrics and params
  - Sends sync_run message, waits for sync_ack response
  - MarkRunSynced updates synced flag in database
- watch.zig: Add --sync flag for continuous experiment sync
  - Auto-sync runs to server every 30 seconds when online
  - Mode detection with offline error handling
2026-02-20 21:28:34 -05:00
Jeremie Fraeys
f5b68cca49
feat(cli): Add metadata commands and update cancel
- note.zig: New unified metadata annotation command
  - Supports --text, --hypothesis, --outcome, --confidence, --privacy, --author
  - Stores metadata as tags in SQLite ml_tags table
- log.zig: Simplified to unified logs command (fetch/stream only)
  - Removed metric/param/tag subcommands (now in run wrapper)
  - Supports --follow for live log streaming from server
- cancel.zig: Add local process termination support
  - Sends SIGTERM first, waits 5s, then SIGKILL if needed
  - Updates run status to CANCELLED in SQLite
  - Also supports server job cancellation via WebSocket
2026-02-20 21:28:23 -05:00
Jeremie Fraeys
d0c68772ea
feat(cli): Implement unified run wrapper command
- Fork child process and capture stdout/stderr via pipe
- Parse FETCHML_METRIC key=value [step=N] lines from output
- Write run_manifest.json with run metadata
- Insert/update ml_runs table in SQLite with PID tracking
- Stream output to output.log file
- Support entrypoint from config or explicit command after --
2026-02-20 21:28:16 -05:00
Jeremie Fraeys
551597b5df
feat(cli): Add core infrastructure for local mode support
- mode.zig: Automatic online/offline mode detection with API ping
- manifest.zig: Run manifest read/write/update operations
- core/: Common flags, output formatting, and context management
- local.zig + local/: Local mode experiment operations
- server.zig + server/: Server mode API client
- db.zig: Add pid column to ml_runs table for process tracking
- config.zig: Add force_local, [experiment] section with name/entrypoint
- utils/native_bridge.zig: Native library integration
2026-02-20 21:28:06 -05:00
Jeremie Fraeys
d43725b817
build(make): add check-cli and check-sqlite targets
- Add check-cli target to verify CLI build configuration
- Add check-sqlite target to verify SQLite asset availability
2026-02-20 15:51:36 -05:00
Jeremie Fraeys
96c4c376d8
ci(forgejo): add contract tests and docs deployment
- Add contract-test.yml workflow for API contract testing
- Add docs-deploy.yml for automated documentation deployment
2026-02-20 15:51:29 -05:00
Jeremie Fraeys
23e5f3d1dc
refactor(api): internal refactoring for TUI and worker modules
- Refactor internal/worker and internal/queue packages
- Update cmd/tui for monitoring interface
- Update test configurations
2026-02-20 15:51:23 -05:00
Jeremie Fraeys
7583932897
feat(cli): add progress UI and rsync assets
- Add progress.zig for sync progress display
- Add rsync placeholder and release binaries to assets/rsync/
2026-02-20 15:51:17 -05:00
Jeremie Fraeys
2258f60ade
feat(cli): add utility modules for local mode
- Add hash_cache.zig for efficient file hash caching
- Add ignore.zig for .gitignore-style pattern matching
- Add native_hash.zig for C dataset_hash library integration
2026-02-20 15:51:10 -05:00
Jeremie Fraeys
7ce0fd251e
feat(cli): unified commands and local mode support
- Update experiment.zig with unified commands (local + server modes)
- Add init.zig for local project initialization
- Update sync.zig for project synchronization
- Update main.zig to route new local mode commands (experiment, run, log)
- Support automatic mode detection from config (sqlite:// vs wss://)
2026-02-20 15:51:04 -05:00
Jeremie Fraeys
2c596038b5
refactor(cli): update build system and config for local mode
- Update Makefile with build-sqlite target matching rsync pattern
- Fix build.zig to handle SQLite assets and dataset_hash linking
- Add SQLite asset detection mirroring rsync binary detection
- Update CLI README with local mode documentation
- Restructure rsync assets into rsync/ subdirectory
- Remove obsolete files (fix_arraylist.sh, old rsync_placeholder.bin)
- Add build_rsync.sh script to fetch/build rsync from source
2026-02-20 15:50:52 -05:00
Jeremie Fraeys
ff542b533f
feat(cli): embed SQLite and unify commands for local mode
- Add SQLite amalgamation fetch script (make build-sqlite)
- Embed SQLite in release builds, link system lib in dev
- Create sqlite_embedded.zig utility module
- Unify experiment/run/log commands with auto mode detection
- Add Forgejo CI workflow for building with embedded SQLite
- Update READMEs for local mode and build instructions

SQLite follows rsync embedding pattern: assets/sqlite_release_<os>_<arch>/
Zero external dependencies for release builds.
2026-02-20 15:50:04 -05:00
Jeremie Fraeys
6028779239
feat: update CLI, TUI, and security documentation
- Add safety checks to Zig build
- Add TUI with job management and narrative views
- Add WebSocket support and export services
- Add smart configuration defaults
- Update API routes with security headers
- Update SECURITY.md with comprehensive policy
- Add Makefile security scanning targets
2026-02-19 15:35:05 -05:00
Jeremie Fraeys
02811c0ffe
fix: resolve TODOs and standardize tests
- Fix duplicate check in security_test.go lint warning
- Mark SHA256 tests as Legacy for backward compatibility
- Convert TODO comments to documentation (task, handlers, privacy)
- Update user_manager_test to use GenerateAPIKey pattern
2026-02-19 15:34:59 -05:00
Jeremie Fraeys
37aad7ae87
feat: add manifest signing and native hashing support
- Integrate RunManifest.Validate with existing Validator
- Add manifest Sign() and Verify() methods
- Add native C++ hashing libraries (dataset_hash, queue_index)
- Add native bridge for Go/C++ integration
- Add deduplication support in queue
2026-02-19 15:34:39 -05:00
Jeremie Fraeys
a3f9bf8731
feat: implement tamper-evident audit logging
- Add hash-chained audit log entries for tamper detection
- Add EventRecorder interface for structured event logging
- Add TaskEvent helper method for consistent event emission
2026-02-19 15:34:28 -05:00
Jeremie Fraeys
e4d286f2e5
feat: add security monitoring and validation framework
- Implement anomaly detection monitor (brute force, path traversal, etc.)
- Add input validation framework with safety rules
- Add environment-based secrets manager with redaction
- Add security test suite for path traversal and injection
- Add CI security scanning workflow
2026-02-19 15:34:25 -05:00
Jeremie Fraeys
34aaba8f17
feat: implement Argon2id hashing and Ed25519 manifest signing
- Add Argon2id-based API key hashing with salt support
- Implement Ed25519 manifest signing (key generation, sign, verify)
- Add gen-keys CLI tool for manifest signing keys
- Fix hash-key command to hash provided key (not generate new one)
- Complete isHex helper function
2026-02-19 15:34:20 -05:00
Jeremie Fraeys
f357624685
docs: Update CHANGELOG and add feature documentation
Update documentation for new features:
- Add CHANGELOG entries for research features and privacy enhancements
- Update README with new CLI commands and security features
- Add privacy-security.md documentation for PII detection
- Add research-features.md for narrative and outcome tracking
2026-02-18 21:28:25 -05:00