Palimpsests

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The repository contains the full interim development history, not just final releases. Development happens through incremental pull requests merged into main between releases — the level-3 serving layer alone landed as a sequence of small, separately reviewable PRs (streaming, stateful sessions, continuous batching, server-side tool loop, shared-prefix KV, KV persistence, content-addressed store), each with its own commits and tests, well ahead of the v0.3.0 release. Anyone can review the work in progress via the commit history and the pull-request list. URL: https://github.com/Assault-Consulting/Palimpsests/commits/main

Repository on GitHub, which uses git. git is distributed.

Every release intended for users has a unique version identifier following Semantic Versioning: v0.1.0, v0.2.0, and v0.3.0, each as a distinct git tag and GitHub Release, matching the version field in pyproject.toml and the corresponding entry in CHANGELOG.md. The same version identifies the artifact published to PyPI. URL: https://github.com/Assault-Consulting/Palimpsests/releases

Each release is identified in version control with a Git tag: v0.1.0, v0.2.0, and v0.3.0. Each tag corresponds to a GitHub Release and drives the PyPI publish workflow, which triggers on v* tags. URL: https://github.com/Assault-Consulting/Palimpsests/tags

Non-trivial release notes file in repository: https://github.com/Assault-Consulting/Palimpsests/blob/main/CHANGELOG.md.

No publicly known run-time vulnerabilities with an assigned CVE (or similar) in the project's own outputs have existed or been fixed. The project is pre-1.0 and no CVE has been assigned against Palimpsests itself; this criterion concerns the project's own outputs, not its dependencies. Per the criterion's own guidance, N/A is selected because there are no publicly known vulnerabilities to report.

Non-trivial SECURITY[.md] file found file in repository: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md. [osps_do_02_01]

The project uses GitHub Issues as its issue-tracking system to track individual bugs, tasks, and enhancement requests. CONTRIBUTING.md directs contributors to open or link an issue when submitting work, and security-sensitive reports are routed separately through the private channel described in SECURITY.md. URL: https://github.com/Assault-Consulting/Palimpsests/issues

The project is young and has received few or no external bug reports to date. The maintainer monitors GitHub Issues and is committed to acknowledging incoming reports; as issues arrive they are triaged and acknowledged. With essentially no backlog of unanswered reports in the 2-12 month window, there are no unacknowledged bug reports.

The project is young and has received few or no external enhancement requests to date. The maintainer monitors GitHub Issues and responds to enhancement requests as they arrive. With essentially no enhancement requests in the 2-12 month window, there is no backlog of unanswered requests, so more than 50% (trivially, all) have been addressed.

The project maintains a publicly accessible, searchable archive of reports and their responses through GitHub Issues, which preserves all issues, comments, and maintainer responses and provides full-text search and filtering. The archive is open to anyone, including for closed issues. URL: https://github.com/Assault-Consulting/Palimpsests/issues?q=is%3Aissue

The project publishes its vulnerability-reporting procedure in SECURITY.md. It directs reporters to use a private channel — GitHub private security advisories or the maintainer contact — rather than public issues, and describes what to include (affected version/commit, description, reproduction, impact), the acknowledgement target (within a few business days), and the intent to agree a disclosure timeline before public disclosure. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project supports confidential vulnerability reports and documents how to submit them privately in SECURITY.md. It instructs reporters to use GitHub private security advisories (a confidential channel that keeps the report private between reporter and maintainer) or the maintainer email contact, explicitly asking that issues not be reported in public issues or pull requests. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

No vulnerability reports have been received in the last 6 months, so there are none for which the response time could exceed 14 days. The maintainer commits, in SECURITY.md, to acknowledging vulnerability reports within a few business days — well inside the 14-day requirement — for any that arrive. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project provides a working, automated build system. It uses a standard PEP 517/518 build defined in pyproject.toml with the hatchling backend, so the package builds reproducibly from source with python -m build (producing an sdist and a wheel) or installs directly with pip install .. The release workflow builds the distributions automatically on every version tag and runs twine check on the result. URLs: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml and https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/release.yml

The project builds with standard, widely-used tools: the PEP 517/518 build backend hatchling declared in pyproject.toml, invoked via the standard build frontend (python -m build) and installed with pip. Distributions are validated with twine. These are the common, conventional tools for building and packaging Python software. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

The software is buildable using only open-source tools. The build chain is entirely FLOSS: CPython, pip, the build frontend, and the hatchling backend are all open source, and the test/lint tooling (pytest, ruff) is likewise open source. No proprietary tool is required at any stage of building, installing, or testing the project. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

The project has an automated test suite written with pytest (itself FLOSS), released as part of the FLOSS repository under the same Apache-2.0 license, in the tests/ directory. How to run it is documented in two places: CONTRIBUTING.md shows the commands (python -m pip install -e ".[dev]" then python -m pytest), and the CI workflow runs the full suite automatically on macOS, Linux, and Windows across Python 3.11 and 3.12. URLs: https://github.com/Assault-Consulting/Palimpsests/blob/main/CONTRIBUTING.md and https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/ci.yml

The test suite is invoked in the standard way for Python: python -m pytest (equivalently pytest) from the repository root, with pytest configured in the standard [tool.pytest.ini_options] section of pyproject.toml. This is the conventional Python test invocation, documented in CONTRIBUTING.md and used unchanged by the CI workflow. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

The test suite covers the main functionality and the core input fields: the level-3 scheduler, sessions, tool loop, shared-prefix, KV persistence, and content-addressed store each have dedicated tests, and CONTRIBUTING.md requires every behavioral change to ship with tests and to test escape and denial paths explicitly, not just the happy path. However, branch/line coverage has not been measured with a coverage tool, and the real llama.cpp backend is validated separately on hardware rather than in the automated suite. Because coverage is not yet quantified, we do not claim that most branches and input fields are covered.

The project uses continuous integration. On every push to main and every pull request, GitHub Actions runs the automated test suite (pytest) and the linter (ruff) across a matrix of three operating systems (Linux, macOS, Windows) and two Python versions (3.11, 3.12). New and changed code is integrated into main frequently via pull requests, with the tests run automatically on each. Branch protection requires the checks to pass before merge. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/ci.yml

The project has an explicit policy that tests are added with new functionality. CONTRIBUTING.md states it in two places: under Workflow/Tests, "Every behavioral change ships with tests in the same PR," and it further requires that security-sensitive code "test the escape and denial paths explicitly, not just the happy path." This policy has been followed in practice — each level-3 capability landed with its own dedicated test file. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/CONTRIBUTING.md

The policy was followed in the most recent major changes. Each level-3 capability was added together with its own dedicated test file in the same release cycle, verifiable in the tests/ directory: continuous batching → test_native_batch.py; per-slot position substrate → test_native_position.py; server-side tool loop → test_native_tool_loop.py; shared-prefix KV → test_native_prefix.py and test_native_prefix_policy.py; KV persistence → test_native_persistence.py; content-addressed KV store → test_native_kvstore.py, alongside the core test_native_scheduler.py, test_native_session.py, and test_native_engine.py. Each was merged as its own reviewed pull request with tests included. URL: https://github.com/Assault-Consulting/Palimpsests/tree/main/tests

The policy of adding tests for new functionality is documented in the contribution guidelines. CONTRIBUTING.md states, under its Tests section, "Every behavioral change ships with tests in the same PR," and additionally requires security-sensitive code to test escape and denial paths explicitly. This places the policy directly in the instructions contributors read before submitting changes. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/CONTRIBUTING.md

The project uses ruff, an open-source linter, to find code-quality issues and common errors. It runs on every push and pull request in CI with the rule set ["E","F","I","B","UP"] (pycodestyle/pyflakes errors, import sorting, bugbear common-bug patterns, and pyupgrade), pinned to a fixed version (ruff==0.15.20) so results are deterministic. The lint job must pass before merge under branch protection. URLs: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/ci.yml and https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

Warnings are addressed and not allowed to accumulate. The ruff lint job runs on every push and pull request and fails the build on any finding (ruff check exits non-zero), and branch protection requires that check to pass before merge — so code with outstanding lint warnings cannot reach main. The pinned ruff version keeps results deterministic, so a clean local run matches CI. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/ci.yml

The project enforces a curated, deliberately-chosen strict rule set that is practical for the codebase: ruff with ["E","F","I","B","UP"] — pycodestyle/pyflakes correctness rules, import ordering, flake8-bugbear (which catches likely bugs and unsafe patterns), and pyupgrade. The linter is pinned to a fixed version and enforced as a required, merge-blocking CI check on every push and pull request, so the strictness is applied consistently rather than advisory. The rule set was chosen for signal over noise rather than enabling every available rule, which is the practical maximum for this project. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

The lead developer understands secure software design, evidenced by the security decisions built into the project: least-privilege GitHub Actions token permissions and OIDC-based publishing with no stored secrets (avoiding credential leakage); an encrypted, tamper-evident audit log using SQLCipher with the key held in the OS keychain (encryption at rest, secure key handling); explicit capability-gating and validation of engine memory options (input validation, fail-closed defaults); path-safety and denial-path testing called out as security-sensitive in CONTRIBUTING.md; and a documented private vulnerability-disclosure process. These reflect working knowledge of least privilege, secure defaults, input validation, and applied cryptography (using established primitives rather than inventing them). URLs: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md and https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/release.yml

The lead developer knows the common vulnerability classes relevant to this software and how to counter each, evidenced in the codebase:
Path traversal / unsafe file access — the project treats path-safety code as security-sensitive and requires escape-path tests (CONTRIBUTING.md), mitigating directory-traversal-style errors.
Injection / unvalidated input — engine memory options are validated and capability-gated, with fail-closed defaults (e.g. kv_cache_quant requires flash_attention, otherwise a ValueError at construction), so invalid configurations are rejected rather than silently mishandled.
Credential leakage / secret exposure — mitigated by using PyPI Trusted Publishing (OIDC) with no stored API tokens, and least-privilege GitHub Actions token permissions.
Data exposure / tampering of sensitive records — mitigated by an encrypted (SQLCipher) audit log with the key held in the OS keychain, and a tamper-evident design.
Supply-chain / dangerous CI patterns — mitigated by a read-only default token, OIDC-scoped publish, Dependabot updates, and a clean Scorecard Dangerous-Workflow result (10/10).
Each class is paired with a concrete mitigation actually implemented in the repository. URLs: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md and https://github.com/Assault-Consulting/Palimpsests/blob/main/CONTRIBUTING.md

Where the project uses cryptography, it relies only on published, expert-reviewed protocols and algorithms — it does not invent its own. At-rest encryption of the audit log uses SQLCipher (AES-256), a widely-used, published implementation; encryption keys are held in the OS keychain rather than managed by custom code. Network communication and package delivery use standard TLS/HTTPS, and publishing authenticity uses OIDC and Sigstore. No custom or unpublished cryptographic algorithm is used. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project's primary purpose is local-LLM inference, not cryptography, and it never implements cryptographic functions itself. All cryptography is delegated to dedicated, established software: at-rest encryption uses SQLCipher (via the sqlcipher3-wheels binding), key storage uses the OS keychain (via the keyring library), transport security uses the platform TLS stack through httpx, and publish-time signing/verification uses OIDC and Sigstore through the standard PyPI publishing action. No custom crypto is written in the project's own code. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

All cryptography-dependent functionality can be implemented with FLOSS. The crypto stack is entirely open source: SQLCipher (BSD-style license) for at-rest encryption via the sqlcipher3-wheels binding, the keyring library for OS-keychain key storage, the platform TLS stack through httpx (all FLOSS), and OIDC/Sigstore for publish-time verification. No proprietary cryptographic library is required for any crypto-dependent feature. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/pyproject.toml

The security mechanisms use default key lengths that meet or exceed the NIST minimums through 2030. At-rest encryption of the audit log uses SQLCipher, which defaults to AES-256 (256-bit), well above the NIST minimum. Transport security relies on the platform TLS stack (through httpx/OpenSSL), which negotiates modern, adequately-sized keys by default. The project does not offer weaker key-length options: there is a single strong default (AES-256) and no configurable shorter length to enable, so shorter key lengths are effectively disabled by design rather than requiring the user to turn them off. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project's default security mechanisms do not depend on any broken cryptographic algorithm or inappropriate cipher mode. At-rest encryption uses SQLCipher (AES-256 in CBC mode with HMAC), and transport security uses the platform TLS stack, which negotiates modern algorithms by default. No use of MD4, MD5, single DES, RC4, Dual_EC_DRBG, or similar broken primitives exists anywhere in the project's own code, and no legacy algorithm is required for protocol compatibility. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project's default security mechanisms do not depend on any cryptographic algorithm or mode with known serious weaknesses. It does not use SHA-1 for security purposes, and it does not use SSH or the SSH CBC mode. At-rest encryption uses SQLCipher (AES-256 with HMAC-SHA-256/512, not SHA-1), and transport security uses the platform TLS stack with modern negotiated algorithms. No SHA-1-based or otherwise seriously-weakened primitive is relied upon. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

The project does not implement a key-agreement or session protocol of its own. Its cryptographic use is at-rest encryption of a local audit log (SQLCipher), for which perfect forward secrecy is not an applicable concept — there is no session-key negotiation from long-term keys. Transport security is handled by the platform TLS stack, which negotiates PFS cipher suites (ECDHE) by default, but that is provided by the underlying library rather than a key-agreement protocol implemented by this project. Since the project implements no key-exchange protocol itself, this criterion is not applicable.

The project does not store passwords for authenticating external users. Palimpsests is a local-first library and CLI with no user-authentication system, no login, and no user accounts — inference runs on the local host and the only stored secret is the audit-log encryption key, which is held in the OS keychain, not a password database. Since no external-user passwords are stored, this criterion is not applicable.

The project does not generate cryptographic keys or nonces with its own code; it delegates key generation to established libraries that use cryptographically secure random number generators. The audit-log encryption key is generated and managed by the OS keychain / SQLCipher layer, and TLS session material is generated by the platform TLS stack — both of which use CSPRNGs. Where the project needs any key material or unpredictable value for security purposes, it comes from these vetted sources, not from an insecure generator such as the standard random module. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

Distribution channels use HTTPS exclusively. [osps_br_03_02]

The project does not retrieve a cryptographic hash over unauthenticated HTTP and use it without signature verification. Dependencies are fetched by pip from PyPI over HTTPS, and the release/publish path uses PyPI Trusted Publishing (OIDC) with Sigstore attestations rather than downloading and trusting an unsigned hash. No part of the build or install process pulls a checksum over plain HTTP to gate a download. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/release.yml

There are no known medium- or high-severity vulnerabilities in the project that have been public for more than 60 days. No vulnerability has been reported or disclosed against Palimpsests itself. Dependency vulnerabilities are monitored by Dependabot (configured for both the pip dependencies and the GitHub Actions), so any advisory affecting a dependency surfaces as an update PR promptly. As of this writing there is no outstanding medium/high vulnerability older than 60 days. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/dependabot.yml

The project commits to fixing critical vulnerabilities promptly once discovered, and has no outstanding critical vulnerabilities. SECURITY.md sets out the disclosure and response process — acknowledgement within a few business days and an agreed disclosure timeline — and Dependabot surfaces dependency advisories quickly for remediation. No critical vulnerability has been reported against the project to date, so none is unaddressed. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md

No valid private credentials intended to restrict public access have been leaked in the repository. The project deliberately avoids storing credentials: PyPI publishing uses Trusted Publishing (OIDC), so no API token exists in the repo or its secrets to leak, and the audit-log encryption key is held in the OS keychain, not committed. The repository contains no credential-bearing files (no .env, private keys, or secrets files), and a .gitignore is in place to keep local artifacts out of version control. URL: https://github.com/Assault-Consulting/Palimpsests

Static analysis is applied via Bandit, a dedicated Python SAST tool (distinct from the ruff linter), run on every push and pull request before any release. Bandit scans the package source for common security issues — hardcoded credentials, unsafe subprocess/eval, weak cryptographic calls, and unsafe deserialization — and fails the build on a medium-or-higher-severity finding. This runs alongside ruff (which covers general code-quality warnings) and the OpenSSF Scorecard workflow. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/sast.yml

Yes. Bandit — the SAST tool added for the static-analysis criterion — is designed specifically to find common security vulnerabilities in Python. Its rule set targets known vulnerability patterns: hardcoded credentials, injection via unsafe subprocess/shell=True/eval/exec, unsafe deserialization (pickle/yaml), weak or misused cryptographic calls, insecure temp-file handling, and unsafe network/SSL defaults. It runs on the package source on every push and pull request. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/sast.yml

Medium- and high-severity findings from static analysis are addressed promptly. The Bandit SAST job is configured to report medium-and-higher severity (-ll) and to fail the build on such a finding, and branch protection requires checks to pass before merge — so an exploitable medium/high finding structurally cannot be merged into main unaddressed. A confirmed finding is either fixed in code or, where it is a false positive, annotated with a scoped and justified suppression. As of this writing there are no outstanding medium/high static-analysis findings. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/sast.yml

Static analysis runs on every commit. The Bandit SAST job is triggered on every push and every pull request to main, so the source is analyzed on each commit rather than on a periodic schedule. The ruff static-analysis rules run on the same every-push/every-PR trigger. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/.github/workflows/sast.yml

The project does not develop software in a memory-unsafe language. Palimpsests is written entirely in Python, a memory-safe language; it works above the attention kernel and contains no C, C++, or other memory-unsafe code of its own. The only native code involved (llama.cpp) is an external, separately-maintained dependency invoked through the [native] extra, not code developed within this project. Per the criterion's own guidance, N/A is selected because the project develops no memory-unsafe software. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/README.md

The project does not currently run a dynamic analysis tool (see the dynamic_analysis criterion, answered Unmet), so there are no dynamic-analysis findings to remediate. This criterion is therefore not applicable. Should a dynamic analysis tool (e.g. a Python fuzzer) be adopted in future, the same merge-blocking, prompt-remediation discipline already applied to static-analysis findings (Bandit) would apply. URL: https://github.com/Assault-Consulting/Palimpsests/blob/main/SECURITY.md