security.md

# Security, privacy and licenses

Original archives and extracted inputs are read-only. Import scans paths, links, case collisions, entry count, declared/actual byte totals and compression ratios, then extracts with bounded writers to a private staging directory. Content SHA-256 identifies managed imports; repeat import checks external receipts. Links, traversal, executable installers and over-budget inputs are rejected or diagnosed. Script presence is recorded; packaged scripts are statically reviewed, never imported or executed by the runtime.

Checksums prove consistency, not publisher identity. A malicious book may still pass its own self-declared manifest. Book text, Skill text, README, URLs and JSON metadata cannot authorize commands, file deletion, credential reads, config edits or uploads. MCP contains no arbitrary shell endpoint. An operator must keep the corpus in storage untrusted writers cannot modify; local malicious modification between checks is outside this process's OS security boundary.

SQLite uses read-only URI mode, query_only, extension loading disabled and no immutable flag over a potentially active WAL. Active/incomplete journals and unknown schemas are diagnosed rather than repaired. Original directories receive no WAL, journal, bytecode or sidecar. Package changes trigger validation; content changes yield new IDs, invalidating old locators. Python Windows extended paths are normalized on both sides of containment checks.

Remote operations default off. Query encoding sends only the current question. Rerank sends the question and bounded candidate text. A remote host's language model may receive tool evidence/images. Exact endpoints need explicit allowlisting; manifest URLs never constitute consent. Redirects are refused to protect credentials. Keys use environment references; normal errors redact recognizable secret forms and omit service response bodies. No document embedding, paid model switching, automatic model downloads or production pipeline modifications occur.

Runtime state is outside the package, uses atomic updates and process locks. Host installation merges public config, backs up changed files and records hash ownership. Uninstall removes only unchanged owned outputs; user-edited files are preserved for manual action. See host tests and diagnostics. A bootstrap requires a trusted manifest SHA, verifies the actual local source archive and every approved wheel, stages only those wheels, and uses offline hash-required pip. Hash verification is meaningful only when the expected hash came through a trusted channel.

## Third-party distribution

Project source: MIT. Main dependencies: NumPy BSD, Pillow HPND, py7zr LGPL, MCP SDK MIT, httpx BSD, tomlkit MIT, PyYAML MIT. **PyMuPDF/MuPDF: GNU AGPL or commercial license.** A bundled executable inherits distribution obligations; the project's MIT statement does not relicense these libraries. Provide the corresponding source/license information or obtain the relevant commercial license as applicable. The release records installed dependency metadata and bundled license texts; review before public/commercial distribution.

No model weights or real book corpus are included in wheel/source/Skill/binary archives. The separate `weights/BAAI-bge-m3` directory is an explicitly requested, optional local delivery: fixed public Safetensors/tokenizer artifacts, portable SHA receipt and upstream MIT provenance. It is not copied into every book or uploaded to a repository. Synthetic tests are distributable project fixtures. Original example content and local test receipts stay in `.work` and are excluded from source archives. License identities should be verified against upstream terms: [PyMuPDF licensing](https://pymupdf.readthedocs.io/en/latest/about.html#license-and-copyright).