This repository is a local-first, source-cited knowledge base management system, delivered primarily as a Claude Code plugin and a standalone Python CLI tool. It manages Obsidian vaults with a strong emphasis on data integrity, provenance tracking, and deterministic operations. The architecture is a monolithic Python library (`claude_obsidian/`) with a formal transaction system for all vault mutations, a robust lint engine, and a retrieval pipeline (BM25 + optional semantic reranking). It features a sophisticated skill/agent framework for AI integration across multiple hosts (Claude, Cursor, Windsurf, etc.). While primarily an application, it incorporates significant data engineering and research data management (RDM) patterns. The provenance ledger system (`ledgers.py`) enforces strict schemas for sources and claims, including canonical URL handling, content-addressed identity, and evidence validation rules. The retrieval pipeline implements Anthropic's Contextual Retrieval pattern. This hybrid nature makes it a powerful tool for both knowledge management and structured research workflows. The codebase demonstrates exceptionally high craftsmanship in its transaction system, defensive I/O, and deterministic analysis tools. It is actively maintained with a comprehensive test suite and a formal release process. Its primary limitation is platform dependency on Linux/macOS for write operations (WSL required for Windows).
genblaze is a production-grade Python monorepo SDK for orchestrating generative AI media pipelines — image, video, audio, text-to-speech, and chat — across 16+ provider integrations (OpenAI, Google Gemini/Imagen/Veo, NVIDIA NIM, GMICloud, Runway, Luma, Replicate, FAL, ElevenLabs, AssemblyAI, Hume, LMNT, Stability Audio, Decart, AtlasCloud). The public API is a chainable Pipeline/Step abstraction with batch, streaming, ingest, and agent-loop modes, plus a Click-based CLI (extract/verify/replay/index) for manifest inspection, a schema-first spec package generating TypeScript types from JSON Schemas, and ~30 runnable examples. Architecturally it is a monorepo: libs/core (genblaze-core) contains the framework (pipeline, providers, model registry, storage, media handlers, canonical hashing, signing, observability, webhooks), while each connector under libs/connectors/* is an independently versioned package registering itself via plugin entry points. Key entry points are Pipeline.run()/batch_run()/stream() for programmatic use and the genblaze command line; data flows through provider submit/poll/fetch_output lifecycles, optional caching, S3/B2 object-storage sinks with URL policies, and manifest generation that can be embedded directly into output media files. Two capabilities set this apart. First, provenance: every run produces a canonical, hash-verified Manifest (SHA-256 over deterministically serialized JSON), optionally Ed25519-signed, and byte-preservingly embedded into JPEG/PNG/WebP/MP4/audio files via XMP/atom splicing without re-encoding. Second, security and reliability engineering: SSRF protection with DNS pinning, credential redaction, ReDoS-safe pattern heuristics, ffmpeg injection escaping, configurable retry policies, model liveness probes, and discovery-aware validation (NATIVE/PARTIAL/NONE support levels) that reduces hardcoded slug rot. The project is actively maintained with unusually thorough tooling: golden hash-stability tests, a provider conformance test base class (~15 contract checks per connector), pin-parity and PyPI-metadata release gates, zizmor/dependabot CI, and live probe scripts that fail on API drift. Main risks are the inherent churn of 16+ third-party APIs (mitigated but not eliminated by mock-heavy tests) and a package/versioning layout complex enough that installs rely on documented make targets. Overall this is a strong, well-architected application SDK — suitable both for direct use and as a reference for multi-provider integration frameworks.
OpenRath is a framework for building LLM-powered AI agent applications with a torch-like API design. It centers on the Session abstraction (analogous to a Tensor) that flows through Sandboxes (execution environments), Memories (persistent state), and Tools (callable operations), orchestrated by Agents and Workflows. The framework provides session lineage tracking, sandboxed tool execution, memory persistence, and LLM provider abstraction, enabling the creation of multi-agent workflows with durable state and traceable provenance. The architecture is modular and extensible, featuring pluggable backends for sandboxes (local, OpenSandbox) and memory systems (local, OpenViking), a registry pattern for dynamic backend loading, and lazy evaluation of sessions for performance. Key innovations include write-ahead logging for crash-resistant session persistence, resource-keyed parallelism for safe concurrent tool execution, and unified garbage collection across session, sandbox, and memory domains. The framework is designed for production use, with extensive testing, clear documentation, and active maintenance.
VeritasGraph is a comprehensive, governed GraphRAG and agent framework for building enterprise-grade knowledge graphs with verifiable attribution. The repository contains a core Python library (VeritasReason) for knowledge graph construction, semantic extraction, reasoning, provenance tracking, and export, along with multiple domain-specific applications: a HIPAA-safe clinical knowledge graph pipeline (clinical-kg), a floorplan extraction and validation web app (floorplan-kg), a municipality incident reporting chatbot, and a Model Context Protocol (MCP) server for IDE integration. The architecture is modular, with a plugin-based method registry pattern, unified configuration management, and a pipeline orchestration engine. While the primary character is an application framework, it also includes research-oriented components such as clinical benchmarks (MedKG-Signal) and evaluation suites, making it a hybrid project with a strong application focus.
This repository hosts the SLSA (Supply-chain Levels for Software Artifacts) specification, a security framework for software supply chain integrity. It is primarily a documentation and specification project, not a software application or a data pipeline. The repository contains the normative specification documents (e.g., build provenance, source requirements, dependency track), a Jekyll-based website for versioned publication, tooling scripts for linting and version management, and CI/CD workflows for maintaining the site. It defines formal attestation schemas in Protobuf and CUE, provides threat models and security principles, and includes community blog posts and how-to guides. While not a standalone deployable application, it serves as the authoritative reference for SLSA levels, tracks, and verification protocols, and its reusable patterns (provenance predicate formats, site navigation components, assessment prompts) can be adopted by other security specification projects.
This repository is a thin GitHub Actions composite action that serves as a wrapper around `actions/attest`. It provides a user-friendly interface for generating signed build provenance attestations for workflow artifacts, delegating all actual logic to the underlying `actions/attest` action. The action.yml defines inputs (subject-path, subject-digest, etc.) and outputs (bundle-path, attestation-id, etc.) and passes them directly to the pinned version of `actions/attest`. There is no custom code; the entire implementation is a single composite step. The CI workflow tests the action by running it with a dummy subject digest. The repository is actively maintained with dependabot and CI, but it offers no reusable components or novel engineering patterns.