CommitLore

The evidence shows a repository-local design based on Git trailers, notes, and a rebuildable SQLite index, without a hosted memory service. Workflows declare narrow permissions and isolate jobs that execute contributor code from jobs holding publication credentials. The README and SECURITY.md explain how records enter Git, reach hosts, why default author matching is not authentication, how signed mode fails closed, and that CommitLore no longer controls data after a host receives it. Content is scanned for secrets before staging, injection-shaped records are withheld from model-readable routes, production dependencies face a zero-threshold audit, and most third-party Actions are commit-pinned. External writes, notes pushes, hook chaining, and PR comments are documented; uninstall restores prior hooks and the index is disposable. Deductions: repository-level auto mode can stage approved records without per-record confirmation, npm packages use version ranges while development audit findings are non-blocking, and source ownership and licensing are stated but publisher identity is not independently verified by the supplied evidence.

The README, SECURITY.md, package metadata, CI, and tests are internally consistent about storage, trust grades, installation, and GitHub Action behavior. CI checks the exact Node floor and current LTS, Git behavior across operating systems, full history and notes availability, clean-clone execution, packaged entry points, actual execution of every test file, and machine-derived documentation figures. Tests exercise shallow clones, missing refs, read-only tokens, remote rejection, and non-permission failures with specific diagnostics. The deduction is dependency availability: operation requires a recent Node 22.23.2+, Git, and access to a pinned GitHub source tag; there is no public npm fallback, and Git notes are absent from ordinary clones until configured.

Documentation covers Claude Code, Codex, Hermes, MCP hosts, AGENTS.md-style hosts, macOS, Linux, Windows, squash merges, and alternative trust modes. It clearly excludes general user memory, conversation archives, and vector-database use. Boundaries are unusually explicit: capture is not deterministic, delivery does not block edits, coverage may be partial, notes require special fetching, guard quality is limited, and unsigned directives provide weak identity assurance. Trigger precision loses a point because no host is certified to evaluate every eligible commit and pre-edit delivery may run on several high-frequency tool calls. Environment fit loses a point because the supplied CI evidence primarily establishes Linux and macOS behavior; Windows has instructions but no equivalent test evidence, while the strict Node floor and notes setup add integration constraints.

The README has a coherent quick start, capability matrix, mechanism overview, limitations, evidence section, and documentation index. Installation is pinned to v1.5.1 and covers script inspection, manual cloning, upgrades, uninstall behavior, session restarts, hook chaining, and squash-merge configuration. Protocol terms, commands, record fields, and package versions are stable and test-constrained; examples and operational edge cases are extensive. MIT metadata matches the full LICENSE. Deductions: the material identifies releases, the current version, a stable protocol, and a latest-release-only support policy, but supplies no complete changelog. It provides private vulnerability reporting, response expectations, and issue routes, but not an independently verifiable maintainer team, succession plan, or explicit division of maintenance responsibility.

Path-, lifecycle-, and trust-scoped output exposes constraints, rejected alternatives, warnings, record IDs, and commit identifiers in an immediately usable pre-edit format; partial and truncated results are labeled. Its Git ownership, lifecycle retirement, path scoping, and trust grading provide concrete marginal value over generic text retrieval. Cost and benefit are treated quantitatively but conservatively through re-proposal rates, retired-record leakage, 100k-commit lookup results, token exposure, per-hook payload limits, and zero cost for repositories without records. Full scores reflect the unusually concrete static evidence and disclosed limitations; they do not imply that this review executed or independently reproduced the measurements.

Core claims trace to named commands, protocol fields, configuration keys, CI gates, test assertions, and benchmark-derived reporting. Security, installation, capability, and evidence claims in the README are corroborated by SECURITY.md, package metadata, both workflows, and Action tests. CI requires README figures to be regenerated, protocol examples to stay synchronized, and test files not to disappear silently. Fact/inference separation is explicit: the field report is labeled non-measurement, the agent study is not generalized, delivery is not equated with reading or compliance, an empty guard result is not called safe, and author matching is not called authentication. No material static-source deduction is identifiable for these three criteria, while confidence remains low because nothing was executed or independently reproduced.