EPISTEMOS v0.7.0 — EPCTX Protocol

Any agent can consume EPISTEMOS context through EPCTX/1.

EPISTEMOS v0.7.0 turns the Context Envelope into a stable, provider-agnostic consumption protocol.
The same document, with the same semantics, over three transports:

from epistemos.protocol.client import LocalContextClient, RestContextClient, McpContextClient
doc = client.context("Datastore", intent="current")   # -> EPCTX/1

• SDK — in-process LocalContextClient / RemoteClient.context()
• REST — POST /context (+ /context/expand)
• MCP — the epistemos_context tool

What EPCTX/1 guarantees

• Types are explicit. Every object carries object_type; a claim carries belief_state +
  accepted_state, so a disputed claim is never mistaken for an accepted fact.
• Contradictions are a section, not prose. disputed is a field; disputing evidence is separated
  from support.
• Completeness is declared. completeness.complete + machine reasons — silence is never "nothing
  to know".
• Temporal is a contract. Per-object valid/transaction time + is_current; the document says
  whether it holds current and/or historical state. "Now" vs "then" without timestamp math.
• Provenance is queryable. Per-object source / derived_from / evidence refs answer "why is this
  here?" with no internals.
• Tokens are accounted, honestly. token_estimate + tokens_by_section + tokenizer_profile.
• Integrity travels with it. A SHA-256 hash over canonical JSON detects tampering (not crypto).
• Data is never instruction. The optional renderer fences evidence; injection inside evidence
  stays a quoted datum.

Boundaries

Identity is server-side on every transport; the request body / tool args / query never carry
authority. EPISTEMOS returns context and executes nothing — it grants no capability and mandates
no provider. The protocol is adapter-ready for NOMOS / Hermes / OpenClaw and any custom agent,
with no dependency on any of them; those integration notes are spec-only. engine.search and
engine.context are unchanged — nothing existing must migrate.

Experimental

Opaque expansion handles (engine.expand) let a consumer request a collapsed group's members;
they are principal- and temporal-bound and re-authorized live, so a forged, cross-principal,
cross-tenant, or revoked handle yields nothing private. Off the stable path until its own hardening
pass.

Quality gates

996 tests (incl. an EPCTX suite across all three transports) · transport parity · PRIVATE_EPCTX_LEAK
= PRIVATE_EXPANSION_LEAK = CROSS_TENANT_EPCTX_LEAK = 0 · prompt-injection stays data · race 30x ·
chaos · mutation 7/7 killed · ruff + mypy --strict clean · MIT · zero-egress.

Docs: docs/protocol/ ·
final report
· ADR-038…044.

v0.1.0–v0.6.0 and Panel v1.1 are unchanged.

EPISTEMOS v0.6.0 — Context Envelope

Compress the transmission of memory, not the memory.

EPISTEMOS v0.6.0 adds the Context Envelope — a post-retrieval transform that hands an agent an
evidence-preserving, compact context instead of raw retrieval. It is additive: engine.search
is unchanged, and the envelope never widens the candidate set or lowers an authorization boundary.

env = engine.context(principal, "Datastore", intent="current")
# current fact inline; superseded versions folded but reachable;
# context_incomplete=True, reason "history_collapsed"

✅ Stable (shipped, on by default)

• Contradiction pinning — every contradiction retrieved or attached to a retrieved claim is
  delivered inline and never folded. The attached case is re-authorized per principal, so a private
  contradiction on a shared claim never leaks. (ADR-035)
• Intent-aware, safe redundancy collapse — superseded current-state versions fold only for a
  confident current query; true duplicates (identical content_hash) fold always. History,
  corroboration, decisions, reviews, and unique-provenance evidence are never folded. Provenance and
  every folded id stay reachable. (ADR-034)
• Honest context_incomplete — any real omission is declared with a machine-readable reason; a
  true-duplicate collapse loses nothing and is not flagged. (ADR-036)

🧪 Experimental (in the code, off by default)

• Token-budget packing and continuation handles (EnvelopeConfig.budget_pack /
  continuation). Proven useful in research but not hardened to the promotion bar; they can never
  drop a pinned contradiction or a critical item. (ADR-037)

Measured (reproducible)

• Token reduction: up to ~35% in measured redundant scenarios (entity-focused current-state /
  history queries), stable as the corpus grows — 1000+ state changes, and 100/500/2000-entity
  sweeps. Not a universal figure. Broad multi-entity lexical queries see little reduction.
• Zero evidence loss, contradiction loss, temporal regression, and private-context leak.
• Reproduce: python tools/eps08_benchmark.py --entities 250 --versions 4 and --scale.

Quality gates

946 tests · mutation 6/6 killed on the envelope (pin, history, attached-authz, provenance,
completeness, duplicate/corroboration) · race 30× · chaos reproducible · ruff + mypy --strict
clean · MIT.

The science behind "only this"

EPISTEMOS-06 tested Dimensions, Resonance, Microconnections, and Contextual Geometry — and
falsified them (rejected, branch preserved). EPISTEMOS-07 isolated the one surviving mechanism;
EPISTEMOS-08 re-proved it at scale before promoting. A negative result is a real result.

Docs: docs/context/ ·
final report
· ADR-033…037.

v0.1.0–v0.5.0 and Panel v1.1 are unchanged.

EPISTEMOS v0.5.0 — Collaborative Claims

Collaborative Claims — contribution ≠ truth

EPISTEMOS-05 turns Knowledge Spaces into verifiable collaborative epistemology. The system can now answer what has been claimed, by whom, on what evidence, what contradicts it, who reviewed it, what we believe, why, and what remains disputed — without a submission becoming truth by being submitted, and without a majority standing in for verification. No network, no LLM; sovereign, local-first, zero-egress.

What's new

• Claim graph (ADR-028): Claim, Evidence (typed: supports/contradicts/weakens/derived_from, URI+hash references), Review (individual, preserved) — new object kinds reusing the ledger, bitemporal helpers and the v0.4 spaces firewall. A Claim exists whether or not it is believed.
• Belief is derived, never stored (ADR-029): PROPOSED/SUPPORTED/DISPUTED/ACCEPTED/REJECTED/RETRACTED/SUPERSEDED, each explainable. One live dispute ⟶ DISPUTED against any number of confirmations — majority is not truth. A governed acceptance records the coexisting dispute rather than erasing it.
• Governed acceptance via a pluggable policy port: knowledge.accept is a non-default capability enforced in the engine before the policy runs; default LocalDefaultPolicy is deterministic and offline (NOMOS-pluggable, never a dependency). A claimant cannot accept their own claim.
• Four separate identities kept separate: ingesting agent ≠ claimant ≠ source ≠ reviewer.

Security

Four P0 leak invariants held under the adversarial battery: CLAIM_SPACE_LEAK = EVIDENCE_SPACE_LEAK = REVIEW_SPACE_LEAK = PRIVATE_TO_PUBLIC_LEAK = 0. A public claim never exposes private evidence (visibility composition, §15). explain_claim authorizes before traversal.

Verification

855 tests (memory+SQLite parity), mypy --strict clean, ruff clean, targeted mutation 39/39 killed (0 non-equivalent survived), 30-cycle race, crash-recovery chaos, zero-egress trap intact. Baselines v0.1.0–v0.4.0 unchanged. MIT.

See docs/EPISTEMOS_V0_5_FINAL_REPORT.md, docs/claims/, ADR-028/029.

EPISTEMOS v0.4.0 — Knowledge Spaces & Capability Model (developer preview)

EPISTEMOS-04 adds the fundamental boundaries for future collaboration — without shipping a network, federation, or public community. Private by default; shareable by permission.

What's new

• Knowledge Spaces — a visibility lattice PRIVATE < TEAM < ORGANIZATION < COMMUNITY < PUBLIC, orthogonal to tenant. Every object is PRIVATE to its owner by default (fail closed).
• Capability-based authorization — roles are capability sets; enforcement is by capability, never by role name. knowledge.share/knowledge.promote are not default, so no default principal can move knowledge toward PUBLIC.
• Read firewall IDENTITY → TENANT → SPACE → CAPABILITY, applied candidate-boundary-first on every read surface (get, search, current/as_of, timeline, facts_for, recall, explain/provenance, graph, export). Unauthorized objects are dropped before scoring — no leak via content, score, rank, count, or ranking timing.
• Explicit share + monotone promotion with preserved lineage (append-only ledger events). Server-side grants with immediate temporal revocation (no stale-capability replay).

The guarantee

PRIVATE_TO_PUBLIC_LEAK = 0 under the full adversarial battery (crafted import, degraded-index fallback, stale capability, forged membership, cross-space id reference, graph/provenance/export leakage, crash recovery, index corruption).

Quality

• 780 tests, mutation 32/32 killed / 0 survived, race (30 cycles) + chaos green, ruff + mypy --strict clean.
• Backward compatible: v0.3 single-agent behaviour is byte-identical; legacy data migrates to PRIVATE, never PUBLIC.
• Local-first & zero-egress preserved: creating spaces adds no telemetry/sync/upload.

Licensing

EPISTEMOS is now distributed under the MIT License (previously Apache-2.0; see ADR-027).

Answer to the mission question

Can a user safely share selected knowledge with another user or group without exposing the rest of their private knowledge? — Yes, sustained by adversarial evidence.

Docs: docs/spaces/, ADR-024…027, docs/EPISTEMOS_V0_4_FINAL_REPORT.md. Baseline tags v0.1.0/v0.2.0/v0.3.0 unchanged.

EPISTEMOS v0.3.0 — Audit + Capability Uplift (developer preview)

EPISTEMOS — sovereign, graph-native context, memory, provenance & decision-lineage infrastructure for AI agents. Local-first, zero-egress, model-agnostic, storage-agnostic, and clean-room with zero third-party runtime dependencies (Python standard library only).

Developer preview / technical release. Extensively tested and adversarially audited, but not certified "production ready" (no production deployment is claimed). See Known limitations below.

What it is

The layer that answers what the system knows, how it knows it, when it knew it, and where that knowledge came from — independent of any single LLM, provider, vector DB or graph DB. It is not an LLM, an agent, an orchestrator, a policy authority (PDP), a vector database or a graph database.

Core capabilities

• Bitemporal memory — every fact carries valid time (true in the world) and transaction time (believed by the system). Answer "what did we know at T?" and correct the past without destroying history.
• Provenance-first — a hash-chained, tamper-evident event ledger is the source of truth; explain(fact|decision) walks a PROV-style genealogy. Queryable state is a rebuildable projection of the ledger.
• Explainable retrieval — every result reports score_components (lexical/exact/temporal/authority/recency) and why_returned. No opaque similarity score.
• Fail-closed multi-tenant — tenant/agent/namespace on every read and write; unknown scope/auth/schema/integrity ⇒ refuse.
• Local-first, zero-egress — the core makes no network calls and needs no LLM (NullModelProvider). Proven by test.
• Interfaces — Python SDK, localhost REST, and a hostile-boundary MCP server (fixed narrow tool allow-list, server-side identity).

Performance (reproducible; benchmarks/)

• Lexical search (SQLite FTS5 index, v0.2): 100k-record search 6.2 s → 34 ms (~183×) vs the O(N) scan, which is retained as a correctness reference and safe fallback.
• explain() (rebuildable provenance index, v0.3): 1.9 s → ~0.05 ms at 100k (~33,800×), flat with scale.
• Write latency stays ~0.4 ms; the index is transactionally consistent with the store and a broken index never blocks a core write.

Since v0.2.0 (this release, v0.3.0 — audit + capability uplift)

• Adversarial re-audit of v0.2.0: 43 verified findings, every material one fixed with a red→green test — including two cross-tenant leaks, a bitemporal history-rewrite, and index-health blindness.
• New: rebuildable provenance index (ADR-022), opt-in unicode search (ADR-023), and a retrieval-fallback semantics fix (ADR-021).
• 700 tests green · ruff + mypy --strict clean · mutation 25/25 killed · race + chaos batteries green.

Prior tags in this repo: epistemos-v0.1.0 (bitemporal core) and epistemos-v0.2.0 (FTS5 scale-retrieval).

Install & quickstart

pip install -e ".[dev]"        # zero runtime deps; dev extras = pytest/ruff/mypy
python examples/quickstart.py  # end-to-end, no model, no network

from epistemos import Engine, Principal
eng = Engine.open("knowledge.epistemos")   # single local file
ctx = Principal(tenant="acme", agent="claude", namespace="hr")
eng.assert_fact(ctx, subject="Alice", predicate="works_at", object="Acme", valid_from="2026-01-01")

Known limitations (honest)

• Unicode search is opt-in (ASCII tokenizer by default; parity preserved).
• Confidence is not yet bitemporally versioned (confirm() annotates in place — a documented KNOWN_GAP).
• Collaborative/federated multi-writer operation is assessed and designed but not implemented (future EPISTEMOS-04+).
• Integrations with NOMOS/Hermes/OpenClaw are adapter-ready / planned, not shipped.

License: Apache-2.0 · Docs: docs/ (ADRs, threat model, benchmarks, research) · Site: https://voltolini.space/epistemos

EPISTEMOS Panel v1.1 — Hardened Living Knowledge Interface

EPISTEMOS Panel v1.1 is an adversarially-validated hardening of Panel v1 — the local-first,
zero-egress operational interface over the EPISTEMOS core. No new functionality: this release is
bug fixes, permanent regressions, and measured performance. It builds on core epistemos-v0.5.0
(unchanged). MIT licensed.

Security & correctness fixes

• Time-travel future-knowledge leak → fixed (FUTURE_KNOWLEDGE_LEAK = 0). as_of(t) now
  reconstructs state from the ledger using only events with ts ≤ t, so a claim retracted/accepted
  after the viewed instant, or evidence attached later, never appears in the past.
• HTTP request smuggling → fixed. An errored POST no longer leaves its body on a keep-alive
  socket to be re-parsed as a second request (body-drain + consumed-tracking).
• Safe parameter handling. Malformed/missing query params return 400 with a safe message
  instead of a 500 echoing internal Python text; 5xx bodies never echo the exception.
• XSS hardening. The DOM helper's innerHTML sink was removed; all content renders as text.
  Verified inert in-browser; a structural guard test prevents reintroduction.
• Server header no longer advertises the Python runtime version.

Accessibility & responsive

• WCAG AA: 0 structural + 0 contrast issues across all screens (accessible headings, labeled
  time-travel input, aria-live on the realtime feed, role="status" connection, role="dialog"
  palette/inspector, reduced-motion honored). A manual screen-reader pass is still recommended.
• Responsive: 0 horizontal overflow at 320 / 375 / 430 / 768 / 1024 / 1440 / 1920.

Performance (measured)

• Single-pass authorized read-model: at 10k objects, aggregate views are 3–5× faster —
  counts 317→97 ms, overview 363→135 ms, graph 298→86 ms, as_of 274→52 ms — with identical
  semantics (pinned by an equivalence test). Reads remain O(N) in corpus size; a cached
  per-principal index is noted as future work beyond ~10k objects.

Evidence

928 tests · ruff + mypy --strict clean · panel-boundary mutation 9/9 killed · concurrency
battery 30 rounds / 0 errors · crash-rebuild recovery byte-identical · 90-second soak with no
thread/fd leak. Full artifacts: docs/panel/hardening/.

No integrations are promised that do not exist; no scale beyond the measurements above is claimed.

EPISTEMOS Panel v1 — Living Knowledge Interface

The Living Knowledge Interface — the official operational panel for EPISTEMOS. A local-first, zero-egress web app over the epistemos-v0.5.0 core. Not a mockup, not a static dashboard: it renders real data from a real engine and updates live as the ledger grows.

Run it: python -m epistemos.panel --demo (opens http://127.0.0.1:8787/ on a real demo corpus)

What it does

• Knowledge graph explorer — a Canvas force-layout of typed nodes (claim · evidence · review · decision · source · entity · fact) and their relations, with level-of-detail, viewport culling, keyboard navigation, and an accessible list view.
• Claim Center + belief decomposition — every claim's derived belief state (proposed · supported · disputed · accepted · retracted); a claim opens into its evidence (supports / contradicts / weakens / derived_from) and its individual reviews (confirm / dispute). Belief is derived, never stored; majority is not truth.
• Evidence & Reviews — first-class, with the claimant kept distinct from the ingesting agent and from the cited source.
• Decision lineage — a decision's statement resolves to the evidence that led to it, and its outcome.
• Global search + ⌘K command palette — instant, typed, grouped results across everything you are authorized to read.
• Realtime over SSE — live counters, activity feed, and graph updates as the ledger appends, with resume-by-sequence and automatic reconnect. No reload, no fake timers.
• Timeline + Time Travel — replay the real bitemporal ledger and view any past instant as it was believed.
• Spaces · Agents · Sources · Health — governance and operations surfaces, with trust ≠ truth kept explicit and honest system health.
• Server-side authorization — every surface is gated by one core predicate, Engine.is_readable(principal, obj).
• Local-first, no mandatory cloud — binds to 127.0.0.1, runs fully offline, strict default-src 'self' CSP.

Security — private data never reaches an unauthorized surface

Authorization stays in the core; the browser is a read-only consumer that grants nothing. The event stream is filtered at the source and carries a redacted envelope, never a raw payload — the browser cannot hide what it never receives. Proven by a private-leak test battery and a full-stack HTTP boundary test:

PRIVATE_UI_LEAK = PRIVATE_GRAPH_LEAK = PRIVATE_SEARCH_LEAK = PRIVATE_STREAM_LEAK = 0

How it is built

Three layers, one direction of trust: Core → API/Event boundary → Panel. Pure standard library server + vanilla ES-module JavaScript — no framework, no npm, no CDN, forced by the zero-egress / zero-dependency constraints. One additive core method (Engine.is_readable) is the entire authorization surface the panel depends on. See ADR-030 … ADR-032 and docs/panel/.

Evidence

• 877 tests green (855 core + 22 panel, including the private-leak battery and a real ephemeral HTTP server), mutation 39/39 killed on the claim core, ruff + mypy --strict clean.
• Performance: graph render ~0.2 ms at 1,500 nodes; authorized boundary ~50 ms at 1k objects; lexical search ~34 ms at 100k via the FTS index.
• Baselines v0.1.0 … v0.5.0 unchanged. NOMOS, Hermes and OpenClaw untouched (not integrated).
• Full report: docs/EPISTEMOS_PANEL_V1_FINAL_REPORT.md.

Honest caveat

WCAG AA is implemented and manually verified (keyboard-first, ARIA, not-color-alone, accessible graph list view); an automated axe-core + screen-reader sweep is the recommended next validation. Nothing here is reported as passing that was not verified.

MIT licensed. Clean-room, zero third-party runtime dependencies.