Simplicity

Small enough to read in an afternoon.

Each library does one job, adds few dependencies and no network code, and runs algorithms short enough to check by reading.

Dependencies, counted

Crate	Direct	Which	All packages	Python package needs
Harpe (`harpe`)	0	none	0	`pydantic>=2`
Kibisis (`kibisis`)	0	none	0	`cryptography>=42`, `pydantic>=2`, `sqlcipher3>=0.5`
Argus (`argus-ledger`)	4	`ed25519-dalek`, `getrandom`, `serde_json`, `sha2`	26	`pydantic>=2`, `cryptography>=42`

Counted with cargo tree -e normal in each repository at its release tag (Harpe v0.1.0-alpha.4, Kibisis v0.1.0-alpha.5, Argus v0.1.0-alpha.4); Python requirements from each pyproject.toml.

No network code

0 network calls in the crates, their Rust dependencies and the Python packages' own source. Details on the security page.

The algorithms, in a few lines each

Harpe

keep = pinned items
left = budget - tokens(pinned)
for item in order(policy):
    if item.tokens <= left:
        keep item; left -= item.tokens
    else:
        drop item

Argus

prev = zero hash
for event in chain:
    if event.prev != prev: broken at event
    if hash(event fields, prev) != event.hash:
        broken at event
    prev = event.hash
if anchor and chain[anchor.seq] != anchor: fail

Kibisis

acquire(r, holder, ttl):
    cur = leases[r]
    if cur not expired and cur.holder != holder:
        refuse
    token = (cur.token if cur else 0) + 1
    leases[r] = (holder, token, now + ttl)

Small surface

Harpe: ContextItem, TokenBudget, PrunePolicy, ContextBudgetEngine, and the TokenCounter trait.
Kibisis: LeaseCoordinator and MemoryVault traits with in-memory implementations in Rust; SQLite-backed ones in Python.
Argus: append, all_events, VerificationPolicy::verify and ChainAnchor.