
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
@mnemoscope/core
Advanced tools
Core memory observability primitives for Mnemoscope: rot scoring, tiering, signed journal.
Core memory observability primitives for Mnemoscope — predictive context-rot scoring, working/episodic/semantic tiering, and an append-only Ed25519-signed hash-chained journal of agent operations on a Markdown vault. 100% local, no runtime dependencies, Node ≥ 22.
This package is the engine the MCP server, the CLI binaries, and the Obsidian plugin all sit on top of. Use it directly if you are integrating Mnemoscope into a custom client.
npm install @mnemoscope/core
import { extractSignature, computeRotScore } from "@mnemoscope/core";
const sig = await extractSignature("/path/to/vault");
const result = computeRotScore(sig);
console.log(result.score); // 0..100
console.log(result.dominantFactor); // e.g. "tokenVolume"
console.log(result.factors); // 5-factor breakdown
console.log(result.topRiskNotes); // top 5 highest-risk notes
import { extractSignature, tierVault } from "@mnemoscope/core";
const sig = await extractSignature("/path/to/vault");
const tiers = tierVault(sig, { workingMaxAgeDays: 7, episodicMaxAgeDays: 90 });
// tiers.working — fresh, inject in full
// tiers.episodic — older but still relevant, inject summary
// tiers.semantic — index only, retrieve on demand
import { Journal } from "@mnemoscope/core";
const journal = await Journal.open("/path/to/vault/.mnemoscope/journal.jsonl", "session-id");
await journal.record("write", "/path/to/vault/notes/foo.md", undefined, "new content");
const verified = await journal.verifyAll();
// { entry: …, valid: true } | { entry: …, valid: false, reason: "signature mismatch" | "chain break: …" | "signed by unknown key …" }
The journal opens (or creates) a per-vault Ed25519 keypair at <vault>/.mnemoscope/keys/ed25519.{key,pub} with the private key chmoded 0600. Each entry's prevHash is the SHA-256 of the previous entry's signature, so field tampering, deletion, and reordering are all detectable.
import { backupPrivateKey, restorePrivateKey } from "@mnemoscope/core";
await backupPrivateKey("/vault/.mnemoscope/keys/ed25519.key", "/safe/backup.enc.json", passphrase);
await restorePrivateKey("/safe/backup.enc.json", "/vault/.mnemoscope/keys/ed25519.key", passphrase);
scrypt (N=2¹⁵, r=8, p=1) + AES-256-GCM, self-describing JSON envelope, no external dependencies. Lose the passphrase and the backup is unrecoverable. Full threat model in docs/key-escrow.md.
import { digestForEntrySig, requestCalendarTimestamp, composeOtsFile } from "@mnemoscope/core";
const digest = digestForEntrySig(entry.sig);
const body = await requestCalendarTimestamp({ digest, calendarUrl: "https://alice.btc.calendar.opentimestamps.org" });
const ots = composeOtsFile(digest, body);
// write `ots` to <vault>/.mnemoscope/timestamps/<sigHashHex>.ots
Pending proofs become Bitcoin-anchored once the calendar's commitment lands in a block (~1 hour). Upgrade and verify with the upstream opentimestamps-client. Full flow in docs/timestamping.md.
| Export | Purpose |
|---|---|
extractSignature(rootPath) | Walk a Markdown vault, return its 5-factor structural signature |
computeRotScore(sig) | Predictive context-rot risk score (v0 heuristic baseline) |
tokenVolumeFactor, semanticRedundancyFactor, … | Individual factor functions, each citation-backed in source |
tierVault(sig, opts) | Working / episodic / semantic split |
Journal | Append-only Ed25519-signed, hash-chained journal |
backupPrivateKey, restorePrivateKey | Encrypted off-vault key escrow |
digestForEntrySig, requestCalendarTimestamp, composeOtsFile, parseOtsFile, verifyOtsHeaderForDigest | OpenTimestamps anchoring of journal entries |
See the package source for the full type declarations and per-function citations.
Apache-2.0 — explicit patent grant.
FAQs
Core memory observability primitives for Mnemoscope: rot scoring, tiering, signed journal.
The npm package @mnemoscope/core receives a total of 3 weekly downloads. As such, @mnemoscope/core popularity was classified as not popular.
We found that @mnemoscope/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.