I Built Tenant-Scoped Memory That Erases for Real — 89 Tests, 27 Mutations, Byte-Level Verified

Description and use

A Python library ragleap-memory enforces tenant isolation inside SQL and guarantees true byte‑level erasure with erase().

Problem

Most memory libraries expose tenant isolation only in application code, leaking existence through different error messages for missing versus out‑of‑scope records.

Outcome

All tests passed (89 for memory, 101 for security), mutation testing killed every mutation (27/27 for memory, 30/30 for security), and byte‑level checks confirmed that erased data is no longer present in the database or journal.

Workflow

• Parse tenant scope with ragleap_security.Scope
• Create SQLiteStore with ragleap_memory.SQLiteStore
• Add entries with store.add(text, type, scope)
• Search entries with store.search(query, scope)
• Supersede entries with store.supersede(id, text, scope)
• Soft delete with store.forget(id, scope)
• Hard delete with store.erase(id, scope)
• Verify byte‑level removal by grepping the database file

Evidence

Tenant isolation enforced inside SQL, not in app code. And erase() actually removes bytes.

Source

After erase, byte-level check: grep -a "New threshold" memory.db → not found

Source

Verified: 101 tests, 30/30 mutations killed, reproducible build matches PyPI.

Source

No Windows / NFS / multi-process writes / power-loss tests

Source