v1.7: SEC-002, performance, dashboard galaxy engine, CI improvements

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.6.1"
+      "version": "1.7"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.6.1",
+  "version": "1.7",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,6 +1,6 @@
-304a88a2af6670407a010b21d8a4580477f67c894437cba1a676350e2ed9a382  .claude-plugin/marketplace.json
-050fca361398c545e41261274ab13795e2544fed3ce05a16cae8570f95154f0a  .claude-plugin/plugin.json
+cfff3064e31d0547e990f325d26fc172397d2d7b453230d5d52aebc7ea3cc79b  .claude-plugin/marketplace.json
+02259d5c35da8c46aac9891655ae3623fc9cb4002aa65d429435714319999745  .claude-plugin/plugin.json
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
-4ce83a2768680ec84488a767fc3bd6cd62688d785010a0abd1d4b3edbf14d03a  skills/engraphis-memory/references/TOOLS.md
-605181000a20a808e570b00cd2e852561f21234f041db03ade73f533b0e8bdaf  skills/engraphis-memory/SKILL.md
+96c8e9b9cee1b3cb43c4bef9e48c57ed92af707f7f7a5d28d73b1ac247d2f0c6  skills/engraphis-memory/references/TOOLS.md
+0f98098df695b9a00dc78402911124ebf09a4a058f6c8bec2c6234ec61fac13a  skills/engraphis-memory/SKILL.md

.dockerignore

@@ -63,3 +63,6 @@ playwright-report
 *.log
 *.whl
 *.tar.gz
+# Test suites and evaluation harnesses — not needed in production images.
+tests/
+eval/

.env.example

@@ -321,9 +321,6 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # rerankers when ENGRAPHIS_REQUIRE_IMMUTABLE_MODELS=1.
 # ENGRAPHIS_RERANK_REVISION=<lowercase 40-character model commit>
 
-# Workspace allow-list: comma-separated names. Empty = all allowed.
-# ENGRAPHIS_WORKSPACES=acme,personal
-
 # Cloud Sync relay: endpoint and optional token for self-hosted relay.
 # ENGRAPHIS_RELAY_URL=https://relay.example.com
 # ENGRAPHIS_SYNC_TOKEN=

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ jobs:
   test:
     name: test + lint (full offline stack)
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -51,6 +52,7 @@ jobs:
   typecheck:
     name: core + backends typecheck (Python 3.11)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -68,6 +70,7 @@ jobs:
   encryption:
     name: encryption driver gate (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -94,6 +97,7 @@ jobs:
   core-py39:
     name: core floor (numpy-only, Python 3.9)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -161,6 +165,7 @@ jobs:
   coverage:
     name: coverage gate (Python 3.11)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -178,6 +183,7 @@ jobs:
   hygiene:
     name: repo hygiene gate (no stray DBs/logs)
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Reject stray runtime artifacts at repo root
@@ -192,6 +198,7 @@ jobs:
   pi-extension:
     name: Pi extension (${{ matrix.os }}, Python ${{ matrix.python-version }}, Node ${{ matrix.node-version }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
@@ -229,6 +236,7 @@ jobs:
   browser-accessibility:
     name: browser accessibility smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -254,6 +262,7 @@ jobs:
     # pyproject.toml, or this workflow). No third-party actions — plain git diff.
     name: docker smoke — path gate
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       run: ${{ steps.decide.outputs.run }}
     steps:
@@ -274,6 +283,7 @@ jobs:
   docker-smoke:
     name: docker build + health smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: docker-gate
     if: needs.docker-gate.outputs.run == 'true'
     steps:
@@ -344,6 +354,7 @@ jobs:
   build:
     name: build + install wheel
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

.gitignore

@@ -7,6 +7,11 @@ __pycache__/
 *.db-shm
 *.db-journal
 *.db.*.bak
+*.sqlite
+*.sqlite3
+*.sqlite-wal
+*.sqlite-shm
+*.sqlite-journal
 
 # Webhook fulfillment runtime state — dedup DB + the undelivered-key fallback,
 # which can contain live license keys. Must never be committed.
@@ -28,6 +33,9 @@ build/
 /engraphis-[0-9]*/
 .pytest_cache/
 /.pytest-*-tmp/
+# Focused UI/API test runs use named repository-local base directories.
+/.pytest-tmp-ui-*/
+/.codex-pytest-tmp/
 .ruff_cache/
 .coverage
 node_modules/

AGENTS.md

@@ -244,6 +244,26 @@ These are pure, unit-tested functions — change them only with a corresponding
   re-verify with `wc -l`/`grep` before trusting a test run against it; clearing `__pycache__`
   alone does not fix this (the staleness is in the source, not in cached bytecode).
 
+### PR delivery protocol for automated maintenance
+
+When an agent is maintaining an open pull request, the matching PR branch or an isolated
+worktree is the delivery boundary:
+
+1. Implement every attributable, safe, scoped review or CI fix in that matching branch or
+   worktree. After tests and lint pass, inspect `git status` and the complete diff, then commit
+   and push every clean, attributable fix and PR worktree file with an ordinary non-force push.
+   A verified fix must not be left only in a local checkout.
+2. Keep unrelated user edits, ambiguous files, credentials, generated databases, logs, and
+   secrets out of the PR. Preserve ambiguous work in its original checkout or a separate
+   worktree and report the exact separation needed; never mix it into an otherwise clean PR.
+3. After each push, recheck the remote CI/workflow results, logs, and current review threads.
+   Continue with safe, attributable iterations until the PR is merge-ready, and report exact
+   files, commits, tests, remaining review items, and blockers.
+4. Never force-push, merge, deploy, publish, delete branches/files, change credentials, rerun
+   workflows, post GitHub comments, resolve review threads, or send external messages without
+   explicit approval. Merge remains prohibited unless the user explicitly approves it, even
+   when checks are green.
+
 ---
 
 ## 7. Source-of-truth docs