offx-zinth/SMP

Review signals: 6 download and execute, 2 hardcoded secret. 2 static matches retained as context.

Reviewed as expected for a test run: a Python interpreter or package manager probed its own interpreter file under a system program folder; attempted writes that failed, so nothing was written.

Source contains download and execute; review its purpose. install.sh 6 findings.

Gitleaks found a possible hardcoded secret; value withheld. index.html

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• SMP parses repositories into a knowledge graph: Real input produced the expected result: Ingested 207 files

  Source: SMP parses your repository into a knowledge graph (memory-mapped, no database)

  Input: .

  Expected: Ingested 207 files

  Command: /tmp/smp-bin/smp ingest . --graph-path /tmp/smp-claim-graph.smpg --max-size 100000

  Observed: Ingested 207 files: 4506 nodes, 18495 edges, 0 errors 2026-10-27T15:11:14.883472Z [info ] journal_replayed  [smp.store.graph.mmap_store] edges=28791 locks=0 nodes=4713 path=/tmp/smp-claim-graph.smpg sessions=0 tx_aborted=0 tx_committed=0 tx_records_corrupt=0 tx_records_dropped=0 2026-10-27T15:11:14.885518Z [warning ] file_too_large

Examples

• Ingest repository into graph: command completed successfully

  Source: README.md / How it works

  Input: repository root

  Expected: ingestion summary reports indexed files

  Command: /tmp/smp-bin/smp ingest . --graph-path /tmp/smp-example-graph.smpg --max-size 100000

  Observed: 0m] directory=<guest-path> edges=18495 elapsed_s=3.83 errors=0 files=207 graph_path=/tmp/smp-example-graph.smpg linked=12100 nodes=4506 phases={'collect': 0.08, 'parse_apply': 3.63, 'apply': 1.21, 'count_edges': 0.0, 'resolve': 0.09} skipped=2 2026-10-27T15:11:23.464107Z [info ] ingest_closed  [smp.cli] close_s=0.01

Local or hosted: local

Index the repository into SMP's graph

pwd && rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '*.yml' -g '*.yaml' | head -80 && git status --short && git rev-parse HEAD 2>/dev/null || true
ls -la; find . -maxdepth 3 -type f | head -80
cat README.md; cat pyproject.toml
python3 --version; python3 -m pip --version; id -u; sed -n '1,240p' install.sh
bash install.sh --local --skip-skills --skip-mcp --dir /tmp/smp-home --bin-dir /tmp/smp-bin
find /tmp/smp-bin /tmp/smp-home/venv -maxdepth 2 -type f | head; /tmp/smp-bin/smp --help; /tmp/smp-bin/smp ingest --help
mkdir -p .coldpass; /tmp/smp-bin/smp ingest . --graph-path /tmp/smp-manual-graph.smpg --max-size 100000; /tmp/smp-bin/smp integrity --help; /tmp/smp-bin/smp-mcp --help
cat /tmp/smp-bin/smp; /tmp/smp-home/venv/bin/pip show tree-sitter tree-sitter-python; sed -n '1,100p' smp/store/graph/parser.py; sed -n '250,380p' smp/cli.py
sed -n '300,355p' smp/store/graph/parser.py; rg=''; grep -n 'tree-sitter not installed\|tree_sitter_languages' smp/store/graph/parser.py
grep -n 'tree_sitter_languages\|tree-sitter-languages' pyproject.toml install.sh
sed -n '380,470p' smp/store/graph/parser.py
sed -n '1,55p' smp/store/graph/parser.py
cat install.sh | tail -140
grep -n 'def _init_parse_worker' -A20 smp/cli.py; /tmp/smp-home/venv/bin/python -c 'import tree_sitter_languages'
python3 -m pip install --disable-pip-version-check tree-sitter-languages
python3 -m venv /tmp/smp-extra-venv && /tmp/smp-extra-venv/bin/pip install tree-sitter-languages
python3 -m pip install --disable-pip-version-check /tmp/smp-extra-venv/lib/python3.12/site-packages/tree_sitter_languages-1.10.2.dist-info 2>&1 || true; /tmp/smp-home/venv/bin/pip install tree-sitter-languages
mkdir -p <guest-path>; /tmp/smp-bin/smp ingest . --graph-path /tmp/smp-manual-graph.smpg --max-size 100000 2>&1 | tail -20
sed -n '1,220p' smp/protocol/mcp.py; sed -n '1,120p' smp/cli.py
grep -n 'def smp_\<email>\|smp_search_code' smp/protocol/mcp.py | tail -30
grep -n 'smp_search_code\|smp_architecture' smp/protocol/mcp.py
sed -n '355,400p' smp/protocol/mcp.py; grep -n 'graph_path' smp/core/config.py
rm -f /tmp/smp-replay-graph.smpg; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/smp-bin/smp","ingest",".","--graph-path","/tmp/smp-replay-graph.smpg","--max-size","100000"],"cwd":"<guest-path>","expected_text":"Ingested 207 files","env":{}}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"SMP parses repositories into a knowledge graph","source":"SMP parses your repository into a knowledge graph (memory-mapped, no database)","input":".","expected":"Ingested 207 files","probe_kind":"cli","argv":["/tmp/smp-bin/smp","ingest",".","--graph-path","/tmp/smp-claim-graph.smpg","--max-size","100000"],"expected_text":"Ingested 207 files","cwd":"<guest-path>","env":{}}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Ingest repository into graph","source":"README.md / How it works","input":"repository root","expected":"ingestion summary reports indexed files","argv":["/tmp/smp-bin/smp","ingest",".","--graph-path","/tmp/smp-example-graph.smpg","--max-size","100000"],"cwd":"<guest-path>","env":{},"expected_text":"Ingested 207 files"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, CLI entry points, and repository scheduler references; SMP's documented behavior is explicit ingestion and query, with no product scheduler or recurring cycle.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Index the repository into SMP's graph","operation_scope":"Installed SMP from the checkout with Python 3.12.3, then indexed the repository using the documented smp ingest command. The first attempt revealed the installed venv lacked tree-sitter-languages; installed it into that venv and reran successfully.","steps":["Checked README requirements; Python 3.12.3 satisfies Python 3.11+.","Ran bash install.sh --local --skip-skills --skip-mcp --dir /tmp/smp-home --bin-dir /tmp/smp-bin.","Installed tree-sitter-languages in /tmp/smp-home/venv after the first ingest exposed its absence.","Ran /tmp/smp-bin/smp ingest . --graph-path /tmp/smp-manual-graph.smpg --max-size 100000.","Validated and replayed probe, README claim, example, and cycle evidence with the coldpass checker."],"deviations":["Initial ingest failed because installed dependencies omitted tree-sitter-languages; installing that package in the installation venv corrected it.","Installer reported a cosmetic stamp write warning because its default stamp path resolved to <guest-path>; installation and launchers succeeded."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
rm -f /tmp/smp-replay-graph.smpg; ls -la .coldpass; cat .coldpass/probe.json
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay >/tmp/final-check.out && python3 -c 'import json; print(json.dumps(json.load(open("/tmp/final-check.out"))["replay"]["status"]))'