v1.0.0 — durable migrations, analytics, semantic retrieval (usearch HNSW), Kimetsu Remote

.github/workflows/ci.yml

@@ -3,7 +3,7 @@
 #
 # Jobs (all required for a green PR):
 #   fmt       — rustfmt check, no diffs allowed
-#   clippy    — clippy with warnings denied (-D warnings)
+#   clippy    — clippy hard gate: -D warnings on lean and embeddings flavors
 #   test      — full workspace test suite
 #   audit     — RUSTSEC advisory scan over the dependency tree
 #
@@ -44,11 +44,8 @@ jobs:
   clippy:
     name: clippy
     runs-on: ubuntu-latest
-    # Advisory for now: main carries a small pre-existing lint backlog.
-    # The job runs and surfaces warnings on every PR; once the backlog is
-    # cleared in a dedicated cleanup PR, drop `continue-on-error` and add
-    # `-D warnings` to make this a hard gate.
-    continue-on-error: true
+    # Hard gate on both the lean (no-default-features) and embeddings
+    # flavors. Any new warning fails the PR.
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
@@ -57,7 +54,8 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           shared-key: ci-clippy
-      - run: cargo clippy --workspace --all-targets
+      - run: cargo clippy --workspace --all-targets --no-default-features -- -D warnings
+      - run: cargo clippy --workspace --all-targets --features embeddings -- -D warnings
 
   test:
     name: test (${{ matrix.os }})
@@ -66,9 +64,9 @@ jobs:
       fail-fast: false
       matrix:
         # Ubuntu is the primary gate; macOS guards the Apple-silicon
-        # build that ships in releases. Windows is exercised by the
-        # release workflow's build matrix.
-        os: [ubuntu-latest, macos-14]
+        # build that ships in releases. Windows now runs the full test
+        # suite here; the release workflow still does the build/smoke.
+        os: [ubuntu-latest, macos-14, windows-latest]
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable

.github/workflows/release.yml

@@ -27,7 +27,7 @@ on:
   workflow_dispatch: {}
 
 permissions:
-  contents: write  # needed to upload release assets
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -42,16 +42,16 @@ jobs:
       matrix:
         include:
           # Linux
-          - { os: ubuntu-latest,  target: x86_64-unknown-linux-gnu, flavor: lean,       extra_features: "--no-default-features" }
-          - { os: ubuntu-latest,  target: x86_64-unknown-linux-gnu, flavor: embeddings, extra_features: "--features embeddings" }
+          - { os: ubuntu-latest,  target: x86_64-unknown-linux-gnu, flavor: lean,       extra_features: "--no-default-features --features pi,openclaw" }
+          - { os: ubuntu-latest,  target: x86_64-unknown-linux-gnu, flavor: embeddings, extra_features: "--features embeddings,pi,openclaw" }
           # macOS Intel
-          - { os: macos-15-intel, target: x86_64-apple-darwin,     flavor: lean,       extra_features: "--no-default-features" }
+          - { os: macos-15-intel, target: x86_64-apple-darwin,     flavor: lean,       extra_features: "--no-default-features --features pi,openclaw" }
           # macOS Apple Silicon
-          - { os: macos-14,       target: aarch64-apple-darwin,     flavor: lean,       extra_features: "--no-default-features" }
-          - { os: macos-14,       target: aarch64-apple-darwin,     flavor: embeddings, extra_features: "--features embeddings" }
+          - { os: macos-14,       target: aarch64-apple-darwin,     flavor: lean,       extra_features: "--no-default-features --features pi,openclaw" }
+          - { os: macos-14,       target: aarch64-apple-darwin,     flavor: embeddings, extra_features: "--features embeddings,pi,openclaw" }
           # Windows
-          - { os: windows-latest, target: x86_64-pc-windows-msvc,   flavor: lean,       extra_features: "--no-default-features" }
-          - { os: windows-latest, target: x86_64-pc-windows-msvc,   flavor: embeddings, extra_features: "--features embeddings" }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc,   flavor: lean,       extra_features: "--no-default-features --features pi,openclaw" }
+          - { os: windows-latest, target: x86_64-pc-windows-msvc,   flavor: embeddings, extra_features: "--features embeddings,pi,openclaw" }
     steps:
       - uses: actions/checkout@v4
 
@@ -69,6 +69,11 @@ jobs:
         run: |
           cargo build --release --locked -p kimetsu-cli --target ${{ matrix.target }} ${{ matrix.extra_features }}
 
+      - name: build kimetsu-remote (server, embeddings archives only)
+        if: matrix.flavor == 'embeddings'
+        run: |
+          cargo build --release --locked -p kimetsu-remote --features embeddings,tls --target ${{ matrix.target }}
+
       - name: smoke-test built binary (doctor --skip-mcp)
         shell: bash
         env:
@@ -107,6 +112,30 @@ jobs:
             tar -czf "$NAME.tar.gz" "$NAME"
           fi
 
+      - name: package kimetsu-remote archive (separate; embeddings targets only)
+        if: matrix.flavor == 'embeddings'
+        shell: bash
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          NAME="kimetsu-remote-${VERSION}-${{ matrix.target }}"
+          mkdir -p "dist/$NAME"
+          if [ "${{ runner.os }}" = "Windows" ]; then
+            cp "target/${{ matrix.target }}/release/kimetsu-remote.exe" "dist/$NAME/"
+          else
+            cp "target/${{ matrix.target }}/release/kimetsu-remote" "dist/$NAME/"
+          fi
+          MIT_LICENSE="LICENSE-MIT"
+          APACHE_LICENSE="LICENSE-APACHE"
+          [ -f "$MIT_LICENSE" ] || MIT_LICENSE="docs/LICENSE-MIT"
+          [ -f "$APACHE_LICENSE" ] || APACHE_LICENSE="docs/LICENSE-APACHE"
+          cp "$MIT_LICENSE" "$APACHE_LICENSE" npm/kimetsu-remote/README.md "dist/$NAME/"
+          cd dist
+          if [ "${{ runner.os }}" = "Windows" ]; then
+            powershell -Command "Compress-Archive -Path $NAME -DestinationPath $NAME.zip"
+          else
+            tar -czf "$NAME.tar.gz" "$NAME"
+          fi
+
       - name: upload artifact
         uses: actions/upload-artifact@v4
         with:
@@ -121,6 +150,10 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
+    permissions:
+      contents: write  # needed to upload release assets
+      attestations: write
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -151,6 +184,26 @@ jobs:
             echo "Generated from the kimetsu monorepo. See README.md for installation + usage." >> release-notes.md
           fi
 
+      - name: generate checksums
+        shell: bash
+        run: |
+          set -euo pipefail
+          : > checksums.txt
+          while IFS= read -r file; do
+            hash="$(sha256sum "$file" | awk '{print $1}')"
+            name="$(basename "$file")"
+            printf '%s  %s\n' "$hash" "$name" >> checksums.txt
+          done < <(find dist -type f \( -name '*.tar.gz' -o -name '*.zip' \) | sort)
+          cat checksums.txt
+
+      - name: attest release artifacts
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            dist/**/*.tar.gz
+            dist/**/*.zip
+            checksums.txt
+
       - name: create release
         uses: softprops/action-gh-release@v2
         with:
@@ -160,6 +213,7 @@ jobs:
           files: |
             dist/**/*.tar.gz
             dist/**/*.zip
+            checksums.txt
           fail_on_unmatched_files: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -414,6 +468,104 @@ jobs:
             ( cd npm/kimetsu && npm publish --access public )
           fi
 
+      - name: assemble + publish kimetsu-remote platform packages
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+
+          # The server ships only where an embeddings build exists (ONNX prebuilts).
+          # npm-key  target-triple  os  cpu  binname  ext
+          PLATFORMS=(
+            "linux-x64    x86_64-unknown-linux-gnu  linux   x64    kimetsu-remote      tar.gz"
+            "darwin-arm64 aarch64-apple-darwin      darwin  arm64  kimetsu-remote      tar.gz"
+            "win32-x64    x86_64-pc-windows-msvc     win32   x64    kimetsu-remote.exe  zip"
+          )
+
+          mkdir -p stage-remote
+          for row in "${PLATFORMS[@]}"; do
+            read -r key target osv cpuv binname ext <<<"$row"
+            stem="kimetsu-remote-${VERSION}-${target}"
+            # The remote archive is uploaded alongside the embeddings kimetsu archive.
+            archive="dist/kimetsu-${target}-embeddings/${stem}.${ext}"
+            if [ ! -f "$archive" ]; then
+              echo "::error::missing kimetsu-remote artifact for ${target}: ${archive}"
+              exit 1
+            fi
+
+            tmp="$(mktemp -d)"
+            if [ "$ext" = "zip" ]; then
+              7z x -y -o"$tmp" "$archive" >/dev/null
+            else
+              tar -xf "$archive" -C "$tmp"
+            fi
+
+            pkgdir="stage-remote/${key}"
+            mkdir -p "$pkgdir/bin"
+            if [ -f "$tmp/${stem}/${binname}" ]; then
+              src="$tmp/${stem}/${binname}"
+            elif [ -f "$tmp/${binname}" ]; then
+              src="$tmp/${binname}"
+            else
+              src="$(find "$tmp" -type f -name "${binname}" | head -n1)"
+              [ -z "$src" ] && src="$(find "$tmp" -type f -name "*${binname}" | head -n1)"
+            fi
+            if [ -z "${src:-}" ] || [ ! -f "$src" ]; then
+              echo "::error::binary ${binname} not found inside ${archive}"
+              find "$tmp" -maxdepth 3 -print
+              exit 1
+            fi
+            cp "$src" "$pkgdir/bin/${binname}"
+            [ "$ext" = "zip" ] || chmod +x "$pkgdir/bin/${binname}"
+
+            node -e '
+              const fs = require("fs");
+              const [dir, name, version, osv, cpuv] = process.argv.slice(1);
+              fs.writeFileSync(dir + "/package.json", JSON.stringify({
+                name,
+                version,
+                description: name + " — prebuilt kimetsu-remote server binary",
+                repository: { type: "git", url: "git+https://github.com/RodCor/kimetsu.git" },
+                license: "MIT OR Apache-2.0",
+                os: [osv],
+                cpu: [cpuv],
+                files: ["bin"],
+              }, null, 2) + "\n");
+            ' "$pkgdir" "@kimetsu-ai/remote-${key}" "$VERSION" "$osv" "$cpuv"
+
+            if npm view "@kimetsu-ai/remote-${key}@${VERSION}" version >/dev/null 2>&1; then
+              echo "skip: @kimetsu-ai/remote-${key}@${VERSION} already published"
+            else
+              echo "publishing @kimetsu-ai/remote-${key}@${VERSION}"
+              ( cd "$pkgdir" && npm publish --access public )
+            fi
+          done
+
+      - name: stamp + publish kimetsu-remote main package
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          node -e '
+            const fs = require("fs");
+            const version = process.argv[1];
+            const p = "npm/kimetsu-remote/package.json";
+            const j = JSON.parse(fs.readFileSync(p, "utf8"));
+            j.version = version;
+            for (const k of Object.keys(j.optionalDependencies || {})) {
+              j.optionalDependencies[k] = version;
+            }
+            fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\n");
+          ' "$VERSION"
+          if npm view "kimetsu-remote@${VERSION}" version >/dev/null 2>&1; then
+            echo "skip: kimetsu-remote@${VERSION} already published"
+          else
+            echo "publishing kimetsu-remote@${VERSION}"
+            ( cd npm/kimetsu-remote && npm publish --access public )
+          fi
+
       - name: summary
         run: |
           VERSION="${GITHUB_REF_NAME#v}"

.gitignore

@@ -44,3 +44,11 @@
 .claude/
 .codex/
 .mcp.json
+
+# Local Codex security-scan artifacts (not part of the project)
+.codex-security-scans/
+/docs/superpowers
+# Real-memory exports must never land in this PUBLIC repo — they belong in
+# the private kimetsu-bench repo, reviewed before commit (memories can carry
+# environment/work context).
+memories-export*.json