OpenKB

least_privilege: CI explicitly sets permissions: contents: read and checkout with persist-credentials: false, and wiki tools deny path escapes (../outside.png, ../../etc/passwd) with 'Access denied', showing least-privilege awareness; however no full permission inventory is provided, so capped at 2. user_confirmation: README claims the SKILL.md is read-only and will not run add/remove/lint --fix without asking, but this is a documentation assertion with no code-level confirmation gate shown, so 1. data_flow_transparency: docs state documents and queries go through LiteLLM to the chosen LLM provider, but there is no systematic disclosure of data flows, retention, or third-party handling, so 1. sensitive_data_handling: only guidance to store LLM_API_KEY in .env and optionally set OPENKB_API_TOKEN; no key rotation, log redaction, or sensitive-document policy, so 1. dependency_security: pyproject pins every direct dependency exactly and comments on the litellm supply-chain incident and the openai version cap; CI uses uv sync --locked to lock transitive deps; strong evidence, 3. external_effects: add/remove/recompile mutate the wiki and .openkb state, and watch auto-compiles continuously, but there is no explicit confirmation design for destructive external effects, so 1. rollback: tests cover rollback of converted artifacts on compile failure, long-doc rollback removing only the newly created blob, dedup hits not deleting pre-existing blobs, and directory-level DirtyRollbackError stopping, so rollback is evidenced, 3. source_attribution: query claims cited answers and the wiki has sources pages, but citation format and provenance tracking details are absent, so 2.

self_consistency: README command tables, pyproject entry points (openkb, openkb-web, openkb-api alias) and tested CLI behavior largely agree, but the conftest fixture uses legacy config fields (embedding_model, chunk_size) inconsistent with README's model/language/pageindex_threshold, indicating doc-code drift, so 2. dependency_availability: dependencies are exact versions available on PyPI, but pageindex==0.3.0.dev3 is a dev pre-release whose availability and long-term stability are questionable, so 2. failure_messages: tests assert clear failure strings such as 'No knowledge base found', 'Unsupported file type', 'does not exist', 'SKIP', 'Access denied', but there is no unified strategy for runtime errors like LLM call failures or network timeouts, so 2.

audience_and_scenarios: README targets developers and knowledge workers with CLI, Web UI, Obsidian, and Claude Code/Codex/Gemini integrations, covering a broad set of scenarios, so 2. capability_boundaries: docs explain short vs long PDF (>=20 pages) handling, local vs cloud PageIndex, and Roadmap gaps, giving fairly clear boundaries, but unsupported formats and scale limits are not systematically listed, so 2. trigger_precision: skill eval claims to check triggering on the right prompts, but trigger conditions, false-trigger rates, or thresholds are undefined, so 1. environment_fit: requires Python >=3.10, optional web extra, Node 20 for frontend builds, and documents timeout tuning for local Ollama/LM Studio; environment fit is described but not exhaustive across platforms, so 2.

information_architecture: README is well structured into What/Getting Started/How it Works/Usage/Configuration/Integrations/REST API with commands organized in two layers, 3. install_notes: pip install openkb, GitHub install, editable source install, web extra, and frontend build are all documented, 3. naming_stability: openkb-api retained as a historical alias and api as a compatibility alias for web show naming-stability awareness, but the project is Alpha with hatch-vcs dynamic versioning, limiting stability, so 2. examples_and_faq: README links extensively to real artifacts under examples/ (commands, chat, skills, slides, rest-api), but those files are not in this evidence set and cannot be verified, so 2. known_limitations: only a Roadmap of unfinished items; no dedicated section on known defects, performance limits, or failure modes, so 1. license: full Apache-2.0 text present and consistently declared in pyproject and README, 3. versioning_changelog: publish.yml documents tag-triggered releases, hatch-vcs version derivation, and auto-generated release notes, but there is no in-repo CHANGELOG file, so 2. maintenance_responsibility: pyproject lists author emails and an Issues link, but publisher identity is unverified and there is no governance, security-response, or maintenance-commitment statement, so 1.

output_usability: outputs include Markdown wiki, cited answers, HTML slide decks, installable skills, and a knowledge graph, all directly usable, but no output-quality evaluation or format spec is provided, so 2. marginal_value: versus traditional RAG, the compiled wiki and PageIndex tree indexing offer differentiated value for long documents, but there is no quantified comparison against alternatives, so 2. cost_benefit: each add triggers multiple LLM calls (a single source may touch 10-15 wiki pages) and long documents may incur PageIndex cloud costs, yet README gives no cost estimate or optimization guidance, so 1.

claim_traceability: most capability claims in README lack verifiable evidence (performance data, benchmarks); examples/ are linked but not included in this evidence, so 1. cross_source_corroboration: README, pyproject, CI workflows, and tests partially corroborate each other (dependency pins, rollback tests), but core functional claims lack multi-source cross-validation, so 1. fact_inference_separation: the docs blend design intent with factual statements (e.g. 'Knowledge compounds', 'accurate and scalable retrieval') without separating verified facts from inference, so 1.