docs: README carries the unique value, not just the memory-layer framing #185

Workflow file for this run

	name: CI

	on:
	push:
	branches:
	- main
	pull_request:

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	python:
	name: Python checks and backend tests
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install backend test dependencies
	run: \|
	python -m pip install --upgrade pip
	python -m pip install -r backend/requirements.txt
	python -m pip install pytest

	- name: Compile Python sources
	run: \|
	python -m compileall -q \
	backend \
	scripts \
	capture.py \
	github_store.py \
	ingest.py \
	instrumentation.py \
	mcp_server.py \
	redis_store.py \
	ui.py

	- name: Run backend unit tests
	# pytest is the canonical runner: conftest.py provides fixtures + temp-dir
	# isolation that `unittest discover` bypasses, and some tests/subtests only
	# behave correctly under pytest.
	run: python -m pytest backend/tests -q

	- name: Run retrieval quality regression gate
	run: python scripts/retrieval_eval.py

	- name: Run MCP tool-routing gate
	run: python scripts/tool_routing_eval.py

	- name: Run universal adapter contract gate
	run: python scripts/adapter_contract_eval.py

	- name: Run context-pack quality gate
	run: python scripts/context_pack_eval.py

	- name: Run per-model token-calibration gate
	run: python scripts/token_calibration_eval.py

	- name: Run agent-task end-to-end gate
	run: python scripts/agent_task_eval.py --deterministic

	- name: Run delivery/push safety gate
	run: python scripts/delivery_eval.py

	# EMBEDDINGS DEMO-INTEGRITY GUARD (CI-visible skip): this job installs
	# backend/requirements.txt only, which does NOT provision the model2vec package or the
	# potion-base-8M weights, so the model2vec-seeded gate legitimately skips here. We do NOT
	# pass --forbid-skip (that would break CI without adding new model-provisioning
	# infrastructure); instead the skip is made EXPLICIT: the eval output is captured and a
	# status=skipped result emits a GitHub notice annotation, so a skip shows up in the job
	# log/summary rather than passing silently. Strict enforcement lives in the release path,
	# where the model is guaranteed present: macos/package_release.sh exports
	# CORTEX_REQUIRE_MODEL=1 and runs check_vector_runtime.py --require-model2vec.
	- name: Run model2vec retrieval-lift gate (explicit skip when model not provisioned)
	run: \|
	python scripts/rerank_eval.py \| tee "$RUNNER_TEMP/rerank_eval.json"
	if grep -q '"status": "skipped"' "$RUNNER_TEMP/rerank_eval.json"; then
	echo "::notice title=rerank_eval status=skipped::model2vec is not provisioned in this CI job, so the semantic retrieval-lift gate did not run. Release artifacts enforce the real model via CORTEX_REQUIRE_MODEL=1 + check_vector_runtime.py --require-model2vec."
	fi

	- name: Run adaptation quality evaluation
	run: python scripts/adaptation_eval.py

	- name: Check connector baseline contract
	run: python scripts/check_connector_baseline.py

	- name: Check beta docs currency
	run: python scripts/check_docs_current.py

	- name: Run backend beta smoke
	run: python scripts/backend_beta_smoke.py

	- name: Run lightweight ops readiness
	run: python scripts/ops_readiness_check.py --skip-tests --skip-build --output-root "$RUNNER_TEMP/cortex-empty-outputs"

	- name: App Store compliance gate (guidelines 2.5.1 / 2.5.2 / 4.8 + privacy/entitlements)
	run: python scripts/appstore_compliance_lint.py

	security-scan:
	name: Security scan (bandit + pip-audit)
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install security tools
	run: \|
	python -m pip install --upgrade pip
	python -m pip install bandit pip-audit

	- name: Bandit static security scan
	# Fail on MEDIUM-or-higher severity findings; documented false-positive test IDs are
	# skipped in .bandit.yaml. Verified this still fails on real issues (e.g. shell=True/B602).
	run: bandit -c .bandit.yaml -r backend scripts -ll

	- name: Audit backend dependencies for known vulnerabilities
	run: pip-audit --strict -r backend/requirements.txt

	- name: Audit top-level dependencies for known vulnerabilities
	run: pip-audit --strict -r requirements.txt

	distribution:
	name: Distribution site and update manifest
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Validate distribution site
	run: python scripts/check_distribution_site.py

	- name: Validate site update manifest
	run: python scripts/validate_update_manifest.py site/downloads/latest.json

	obsidian-plugin:
	name: Obsidian plugin build
	runs-on: ubuntu-latest
	timeout-minutes: 10

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	- name: Set up Node
	uses: actions/setup-node@v4
	with:
	node-version: "22"
	cache: npm
	cache-dependency-path: packages/obsidian-cortex-plugin/package-lock.json

	- name: Typecheck and build Obsidian plugin
	run: scripts/check_obsidian_plugin.sh

	macos-app:
	name: macOS app build
	runs-on: macos-latest
	timeout-minutes: 15

	steps:
	- name: Check out repository
	uses: actions/checkout@v4

	# Dev-mode build: CORTEX_BUNDLE_PYTHON=0 means no bundled interpreter and no bundled
	# model2vec model, so build.sh prints its loud "EMBEDDINGS FALLBACK" warning here — that is
	# expected and non-fatal. CORTEX_REQUIRE_MODEL is deliberately NOT set: this CI job does not
	# provision the model; only release packaging (macos/package_release.sh) enforces it.
	- name: Build app bundle
	env:
	CORTEX_BUNDLE_PYTHON: "0"
	CORTEX_CODESIGN_IDENTITY: "-"
	CORTEX_CODESIGN_TIMESTAMP: "0"
	run: ./macos/build.sh

	- name: Verify ad-hoc signed app
	run: codesign --verify --deep --strict --verbose=2 macos/build/Cortex.app

Navigation Menu

Uh oh!

docs: README carries the unique value, not just the memory-layer framing #185

Workflow file

docs: README carries the unique value, not just the memory-layer framing #185

Uh oh!

Workflow file for this run