Memwork

SQLite plus sqlite-vec for vector storage, because the whole thing has to fit on a laptop. Hybrid retrieval mixes cosine similarity at 0.6 weight with BM25 at 0.4 weight. The numbers came out of a weekend of evaluation on my own notes, not a paper. Tuning that pair was the longest single sub-task in the build.

ES256-signed JWTs. Magic-link login over a paired email pipe. Refresh tokens rotate on every use, and the rotation chain is enforced server-side, so a leaked token only lives for one request. IDOR-hardened service layer. Zod .strict() on every external boundary. CSP, HSTS, X-Frame-Options on every response.

Tests come first. RED before GREEN, every time. The CI pipeline rejects pull requests that flip the order. 279 passing tests at last count. 88% line coverage. 81% branch coverage. Stryker mutation testing runs weekly and holds the critical services between 85 and 92 percent.

Hosting the service shifts the trust assumption from your laptop to mine. That changed how everything else had to work. The HTTP transport ships with rate-limits, audit logging, and an explicit data-export route, because if you're going to host other people's memories you owe them a way out.