feat: MemoryProof memory assurance v1

.dockerignore

@@ -1,9 +1,10 @@
 .git
 .github
-target
+.memoryproof
 .forgetproof
-__pycache__
-*.pyc
-.venv
+target
 dist
 build
+*.pyc
+__pycache__
+conformance/evidence

.github/CODEOWNERS

@@ -1,2 +1,5 @@
 # Default reviewer for project-wide changes.
 * @Hughhhhcoder
+/.github/ @Hughhhhcoder
+/crates/ @Hughhhhcoder
+/python/ @Hughhhhcoder

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -12,8 +12,8 @@ body:
   - type: input
     id: version
     attributes:
-      label: ForgetProof version / 版本
-      placeholder: "0.1.0 or commit SHA"
+      label: MemoryProof version / 版本
+      placeholder: "1.0.0, 0.1.0, or commit SHA"
     validations:
       required: true
   - type: input

.github/dependabot.yml

@@ -12,3 +12,17 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly

.github/pull_request_template.md

@@ -9,8 +9,8 @@
 ## Validation / 验证
 
 - [ ] `cargo fmt --all -- --check`
-- [ ] `cargo clippy --all-targets --all-features -- -D warnings`
-- [ ] `cargo test`
+- [ ] `cargo clippy --workspace --all-targets --all-features -- -D warnings`
+- [ ] `cargo test --workspace`
 - [ ] `PYTHONPATH=python python -m unittest discover -s python/tests -v`
 - [ ] Documentation links and redaction boundaries checked / 已检查文档链接和脱敏边界
 

.github/workflows/ci.yml

@@ -4,40 +4,107 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  test:
+  rust-and-python:
+    name: Rust + Python contract tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: dtolnay/rust-toolchain@stable
-      - uses: actions/setup-python@v5
+        with:
+          components: rustfmt, clippy
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
-      - run: cargo fmt --all -- --check
-      - run: cargo clippy --all-targets --all-features -- -D warnings
-      - run: cargo test
-      - run: python -m compileall -q python
-      - run: PYTHONPATH=python python -m unittest discover -s python/tests -v
-      - name: Validate scenario schema JSON
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+      - name: Lint Rust
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+      - name: Test Rust
+        run: cargo test --workspace -- --test-threads=2
+      - name: Compile Python sources
+        shell: bash
+        run: |
+          set -euo pipefail
+          while IFS= read -r -d '' file; do python -m py_compile "$file"; done < <(find python -name '*.py' -print0)
+      - name: Test Python adapters
+        run: PYTHONPATH=python python -m unittest discover -s python/tests -v
+      - name: Validate scenario schema
         run: python -m json.tool schemas/scenario.schema.json >/dev/null
-      - name: Run passing reference scenario
-        run: cargo run --quiet -- run examples/reference-clean.yml --output .forgetproof/runs
-      - name: Verify evidence bundle
+      - name: Validate action metadata
+        run: ruby -e 'require "yaml"; YAML.load_file("action.yml")'
+      - name: Run passing reference scenarios
         shell: bash
         run: |
-          bundle=$(find .forgetproof/runs -mindepth 1 -maxdepth 1 -type d | head -1)
+          set -euo pipefail
+          cargo run --quiet -- run examples/reference-clean.yml --output .memoryproof/clean
+          cargo run --quiet -- run examples/isolation-reference.yml --output .memoryproof/isolation
+      - name: Verify a generated evidence bundle
+        shell: bash
+        run: |
+          set -euo pipefail
+          bundle=$(find .memoryproof/clean -mindepth 1 -maxdepth 1 -type d | head -1)
           cargo run --quiet -- verify "$bundle"
-      - name: Check leaky reference is detected
+      - name: Check deliberate failures are detected
         shell: bash
         run: |
           set +e
-          cargo run --quiet -- run examples/reference-leaky.yml --output .forgetproof/leaky-runs
-          code=$?
-          test "$code" -eq 1
+          cargo run --quiet -- run examples/reference-leaky.yml --output .memoryproof/leaky
+          leaky=$?
+          cargo run --quiet -- run examples/reference-overdelete.yml --output .memoryproof/overdelete
+          overdelete=$?
+          set -e
+          test "$leaky" -eq 1
+          test "$overdelete" -eq 1
+      - name: Build public matrix
+        run: |
+          python scripts/build_matrix.py
+          python -m json.tool site/matrix.json >/dev/null
       - name: Upload evidence bundles
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: forgetproof-evidence
-          path: .forgetproof/
+          name: memoryproof-evidence
+          path: .memoryproof/
           if-no-files-found: ignore
+
+  cross-platform:
+    name: Cross-platform build (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --workspace --all-targets
+      - run: cargo test --workspace -- --test-threads=2
+
+  official-adapter-contracts:
+    name: Official adapter contracts (local mock)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.11"
+      - name: Start deterministic provider mocks and run all official adapters
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -u scripts/mock_remote_backend.py --provider mem0 --port 8888 >/tmp/mem0.log 2>&1 & mem0=$!
+          python -u scripts/mock_remote_backend.py --provider letta --port 8283 >/tmp/letta.log 2>&1 & letta=$!
+          python -u scripts/mock_remote_backend.py --provider zep --port 8000 >/tmp/zep.log 2>&1 & zep=$!
+          trap 'kill "$mem0" "$letta" "$zep" 2>/dev/null || true' EXIT
+          sleep 1
+          NO_PROXY=localhost,127.0.0.1 no_proxy=localhost,127.0.0.1 \
+            cargo run --quiet -- run examples/mem0.yml --allow-network --output .memoryproof/mem0
+          NO_PROXY=localhost,127.0.0.1 no_proxy=localhost,127.0.0.1 \
+            cargo run --quiet -- run examples/letta.yml --allow-network --output .memoryproof/letta
+          NO_PROXY=localhost,127.0.0.1 no_proxy=localhost,127.0.0.1 \
+            cargo run --quiet -- run examples/zep.yml --allow-network --output .memoryproof/zep

.github/workflows/codeql.yml

@@ -0,0 +1,32 @@
+name: CodeQL / 代码安全分析
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 3 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze ${{ matrix.language }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [rust, python]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@v4
+        if: matrix.language == 'rust'
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/pages.yml

@@ -1,8 +1,9 @@
-name: Build conformance matrix / 构建认证矩阵
+name: Publish Memory Assurance Matrix / 发布记忆保证矩阵
 
 on:
   workflow_dispatch:
   push:
+    branches: [main]
     paths:
       - "conformance/**"
       - "scripts/build_matrix.py"
@@ -16,19 +17,24 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  matrix:
+  build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
-      - run: python scripts/build_matrix.py
+      - name: Build and verify matrix
+        run: |
+          python scripts/build_matrix.py
+          python -m json.tool site/matrix.json >/dev/null
+      - uses: actions/configure-pages@v5
       - uses: actions/upload-pages-artifact@v3
         with:
           path: site
+
   deploy:
-    needs: matrix
+    needs: build
     runs-on: ubuntu-latest
     permissions:
       pages: write