Add GDPR compliance tests and enhance existing functionality

.github/workflows/docker.yml

@@ -15,15 +15,15 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -32,7 +32,7 @@ jobs:
             type=sha
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: deploy/Dockerfile

.github/workflows/pages.yml

@@ -23,7 +23,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       - name: Build with Jekyll
         uses: actions/jekyll-build-pages@v1
@@ -43,4 +43,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.gitignore

@@ -1,3 +1,7 @@
+# Local AI assistant context (not committed)
+CLAUDE.md
+.claude/
+
 # Binaries
 *.exe
 *.exe~
@@ -15,10 +19,10 @@ __debug_bin*
 
 # Code coverage profiles and other test artifacts
 *.out
-coverage.*
+/coverage.out
+/coverage.html
 *.coverprofile
 profile.cov
-coverage.html
 
 # Dependency directories
 vendor/
@@ -65,3 +69,19 @@ Thumbs.db
 *.log
 *.pid
 tmp/
+
+# AI agent local instructions and tooling artifacts
+AGENTS.md
+CLAUDE.md
+GEMINI.md
+COPILOT.md
+.claude/
+.codex/
+.cursor/
+.aider/
+.roo/
+.windsurf/
+.continue/
+.cline/
+.mcp/
+.github/copilot-instructions.md

.golangci.yml

@@ -10,7 +10,8 @@ formatters:
     - goimports
   settings:
     goimports:
-      local-prefixes: github.com/scalytics/kafgraph
+      local-prefixes:
+        - github.com/scalytics/kafgraph
 
 linters:
   enable:
@@ -29,8 +30,6 @@ linters:
           - errcheck
           - gosec
   settings:
-    govet:
-      shadow: true
     revive:
       rules:
         - name: exported

Makefile

@@ -26,6 +26,7 @@ LDFLAGS     := -s -w \
 
 BIN_DIR     := bin
 STAMP_DIR   := .build
+TOOLS_BIN_DIR := $(STAMP_DIR)/bin
 
 DOCKER_REGISTRY ?= ghcr.io/scalytics
 DOCKER_IMAGE    ?= $(DOCKER_REGISTRY)/kafgraph
@@ -36,6 +37,8 @@ COVERAGE_FILE  := coverage.out
 
 GOLANGCI_LINT  ?= golangci-lint
 GOLANGCI_FLAGS ?= --config .golangci.yml
+GOVULNCHECK_VERSION ?= latest
+GOVULNCHECK ?= $(abspath $(TOOLS_BIN_DIR))/govulncheck
 
 JEKYLL         ?= bundle exec jekyll
 DOCS_DIR       := docs
@@ -139,14 +142,18 @@ fmt-check: ## Check formatting (CI gate)
 
 # ─── Security ────────────────────────────────────────────────────────────────
 
+$(GOVULNCHECK):
+	@mkdir -p $(TOOLS_BIN_DIR)
+	GOBIN=$(abspath $(TOOLS_BIN_DIR)) $(GO) install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+
 .PHONY: sec
-sec: ## Run security checks (gosec via lint + govulncheck)
+sec: $(GOVULNCHECK) ## Run security checks (gosec via lint + govulncheck)
 	$(GOLANGCI_LINT) run $(GOLANGCI_FLAGS) --enable-only gosec ./...
-	govulncheck ./...
+	$(GOVULNCHECK) ./...
 
 .PHONY: vulncheck
-vulncheck: ## Check for known vulnerabilities in dependencies
-	govulncheck ./...
+vulncheck: $(GOVULNCHECK) ## Check for known vulnerabilities in dependencies
+	$(GOVULNCHECK) ./...
 
 # ─── Docker ──────────────────────────────────────────────────────────────────
 

README.md

@@ -14,30 +14,65 @@ Apache 2.0. Open beta.
 ---
 
 ## What KafGraph is
-
+ 
 KafGraph is the memory layer for AI agent teams. It ingests every conversation,
 decision, and artifact that flows through your agent group, structures it as a
 queryable property graph, and exposes it back to agents through tool calls. No
 agent ever starts from zero.
-
-```
-Agent conversations  →  Kafka topics  →  KafScale processor  →  KafGraph (BadgerDB)
-                                                                       │
-                                                  ┌────────────────────┤
-                                                  │                    │
-                                            Brain Tool API      Cypher / Bolt v4
-                                            (agent access)      (tooling access)
+
+```mermaid
+%%{init: {'theme':'neutral', 'themeVariables': {
+  'primaryColor':'transparent',
+  'primaryBorderColor':'#1D9E75',
+  'primaryTextColor':'#1D9E75',
+  'lineColor':'#1D9E75',
+  'clusterBkg':'transparent',
+  'clusterBorder':'#1D9E75',
+  'edgeLabelBackground':'transparent'
+}}}%%
+flowchart LR
+    subgraph Agents["AI agent team"]
+        A1[agent.researcher]
+        A2[agent.coder]
+        A3[agent.reviewer]
+        A4[agent.lead]
+    end
+
+    subgraph Transport["Transport"]
+        K[Kafka topics<br/>group.&lt;name&gt;.*]
+        S[(S3 segments<br/>MinIO)]
+    end
+
+    subgraph KG["KafGraph"]
+        P[KafScale processor<br/>5-layer pipeline]
+        G[(Property graph<br/>BadgerDB)]
+        BT[Brain Tool API<br/>7 tools]
+        Bolt[Bolt v4 / OpenCypher]
+    end
+
+    A1 & A2 & A3 & A4 -- conversations,<br/>decisions,<br/>shared memory --> K
+    K --> S
+    S -- direct read,<br/>no broker hop --> P
+    P --> G
+    G --> BT
+    G --> Bolt
+    BT -- brain_search<br/>brain_recall<br/>brain_capture<br/>brain_reflect --> A1 & A2 & A3 & A4
+    Bolt -- inspection,<br/>dashboards --> External((Bolt clients))
+
+    classDef default fill:transparent,stroke:#1D9E75,color:#1D9E75
+    class A1,A2,A3,A4,P,G,BT,Bolt,K,S,External default
 ```
-
+ 
 Two deployment modes from one binary:
-
+ 
 * **Embedded.** A local brain for one agent. BadgerDB on disk, Brain Tool API on
   localhost. Useful for per-agent personalization, coding agents on a developer
   laptop, or air-gapped single-agent workloads.
 * **Distributed.** A shared brain for an agent team. Gossip-based cluster
   membership via `hashicorp/memberlist`, agentID partitioning via FNV-1a,
   cross-partition fan-out RPC. The mode no other agent memory system ships.
 
+
 ## Why "shared brain"
 
 Every other agent memory system on the market (Mem0, Zep / Graphiti, Cognee,