Memory P5 — Sovereignty verification — no network in memory path #265

Timmy · 2026-04-10T01:07:27Z

Timmy commented

2026-04-10 01:07:27 +00:00

Closes #257

What

Adds scripts/verify_memory_sovereignty.py — a CI verification script that checks the memory path has no network dependencies.

How

Scans 8 memory-path files:

tools/memory_tool.py (MEMORY.md/USER.md store)
hermes_state.py (SQLite session store)
tools/session_search_tool.py (FTS5 session search)
tools/graph_store.py (knowledge graph)
tools/temporal_kg_tool.py (temporal KG tool)
agent/temporal_knowledge_graph.py (temporal triple store)
tools/skills_tool.py (skill listing/viewing)
tools/skills_sync.py (bundled skill syncing)

For each file, the script:

Parses AST for network-capable imports (requests, httpx, urllib, openai, anthropic, etc.)
Checks for LLM call functions (async_call_llm)
Regex-scans for hardcoded URLs, socket usage, and other network indicators
Reports violations with file:line references

Exit codes: 0 = sovereign, 1 = violations found.

Known exclusions

tools/graph_store.py — uses GiteaClient for persistence; documented as separate from core memory path
tools/session_search_tool.py — uses LLM summarization; FTS5 search itself is local

These are in KNOWN_VIOLATIONS with justification and excluded from the gate.

Results

Core memory path (MEMORY.md, USER.md, SQLite state.db, temporal KG) is fully sovereign — local filesystem and SQLite only, no network dependencies.

Closes #257 ## What Adds `scripts/verify_memory_sovereignty.py` — a CI verification script that checks the memory path has no network dependencies. ## How Scans 8 memory-path files: - `tools/memory_tool.py` (MEMORY.md/USER.md store) - `hermes_state.py` (SQLite session store) - `tools/session_search_tool.py` (FTS5 session search) - `tools/graph_store.py` (knowledge graph) - `tools/temporal_kg_tool.py` (temporal KG tool) - `agent/temporal_knowledge_graph.py` (temporal triple store) - `tools/skills_tool.py` (skill listing/viewing) - `tools/skills_sync.py` (bundled skill syncing) For each file, the script: 1. Parses AST for network-capable imports (requests, httpx, urllib, openai, anthropic, etc.) 2. Checks for LLM call functions (async_call_llm) 3. Regex-scans for hardcoded URLs, socket usage, and other network indicators 4. Reports violations with file:line references Exit codes: 0 = sovereign, 1 = violations found. ## Known exclusions - `tools/graph_store.py` — uses GiteaClient for persistence; documented as separate from core memory path - `tools/session_search_tool.py` — uses LLM summarization; FTS5 search itself is local These are in KNOWN_VIOLATIONS with justification and excluded from the gate. ## Results Core memory path (MEMORY.md, USER.md, SQLite state.db, temporal KG) is **fully sovereign** — local filesystem and SQLite only, no network dependencies.

Timmy added 1 commit 2026-04-10 01:07:28 +00:00

Add memory sovereignty verification script (#257 )

Forge CI / smoke-and-build (pull_request) Successful in 39s

Details

2e37ff638a

CI check that scans all memory-path code for network dependencies.

Scans 8 memory-related files:
- tools/memory_tool.py (MEMORY.md/USER.md store)
- hermes_state.py (SQLite session store)
- tools/session_search_tool.py (FTS5 session search)
- tools/graph_store.py (knowledge graph)
- tools/temporal_kg_tool.py (temporal KG tool)
- agent/temporal_knowledge_graph.py (temporal triple store)
- tools/skills_tool.py (skill listing/viewing)
- tools/skills_sync.py (bundled skill syncing)

Verifies no HTTP/HTTPS calls, no external API usage, and no
network dependencies in the core memory read/write path.

Reports violations with file:line references. Exit 0 if sovereign,
exit 1 if violations found. Suitable for CI integration.

Rockachopa reviewed 2026-04-10 03:41:35 +00:00

Rockachopa left a comment

Auto-approved: clean diff, no conflicts, mergeable.

Rockachopa scheduled this pull request to auto merge when all checks succeed 2026-04-10 03:41:35 +00:00

Rockachopa merged commit a055e68ebf into main

2026-04-10 03:44:26 +00:00

Rockachopa referenced this issue from a commit

2026-04-10 03:44:27 +00:00

Merge pull request #265

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#265