diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 3e95968f..4721c396 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -9,7 +9,7 @@ "name": "engraphis-memory", "source": "./", "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.", - "version": "1.7" + "version": "1.6" } ] } diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index c0831a73..0bee82ea 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "engraphis-memory", - "version": "1.7", + "version": "1.6", "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.", "author": { "name": "The Engraphis Authors", diff --git a/.claude-plugin/skill-assets.sha256 b/.claude-plugin/skill-assets.sha256 index b3d20634..2f565d53 100644 --- a/.claude-plugin/skill-assets.sha256 +++ b/.claude-plugin/skill-assets.sha256 @@ -1,5 +1,5 @@ -cfff3064e31d0547e990f325d26fc172397d2d7b453230d5d52aebc7ea3cc79b .claude-plugin/marketplace.json -02259d5c35da8c46aac9891655ae3623fc9cb4002aa65d429435714319999745 .claude-plugin/plugin.json +4c18cdb509babb853ac7e5283ca9b309e2669b82ff098f3acf33238a9e4c1114 .claude-plugin/marketplace.json +94bfa06317a8fe6a6a7e204bb70c5abdc9e4bbc34d79dd6f8447a30140bc8b85 .claude-plugin/plugin.json 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66 skills/engraphis-memory/references/CONVENTIONS.md 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f skills/engraphis-memory/references/SCOPING.md 96c8e9b9cee1b3cb43c4bef9e48c57ed92af707f7f7a5d28d73b1ac247d2f0c6 skills/engraphis-memory/references/TOOLS.md diff --git a/CHANGELOG.md b/CHANGELOG.md index cc671412..62da69d9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,8 +5,6 @@ All notable changes to Engraphis are documented here. Format loosely follows ## [Unreleased] -## [1.7] - 2026-08-14 - ### Changed @@ -142,7 +140,7 @@ All notable changes to Engraphis are documented here. Format loosely follows interpolation, eliminating a fragile SQL construction pattern (SEC-002). - The `pypdf` dependency floor is raised to `>=6.15.0` to address PYSEC-2026-3655 and PYSEC-2026-3656 (arbitrary code execution via crafted PDF objects). -## [1.6] - 2026-08-08 +## [1.6] - 2026-08-15 Minor release advancing the v2 engine through schema 16 with deterministic sync state, trusted local document and Obsidian import, tighter trust boundaries, synchronized agent guidance, and diff --git a/README.md b/README.md index 9cbb5c7b..1a3d58ed 100644 --- a/README.md +++ b/README.md @@ -179,13 +179,7 @@ selection, set `ENGRAPHIS_UPDATE_EXTRAS` to a comma-separated list (for example > across re-imports, binds adapters and target scopes, and retains only bounded, content-free > per-job format/result metadata. The schema 16 migration persists each import job's optional session target > and requires source lineage and job-item attachments to remain in that exact session. See the -> [1.6 release notes](https://github.com/Coding-Dev-Tools/engraphis/blob/main/CHANGELOG.md#16---2026-08-08). - -> **Upgrading to 1.7:** no schema migration required (schema 16 unchanged). This release hardens -> security (removes path echoes in HTTP errors, eliminates `repr(float)` SQL interpolation, patches -> pypdf CVEs), improves performance (union-find consolidation, bounded recall cache), and adds the -> all-node LOD graph renderer (20,000 nodes, 200,000 relations, worker-backed). See the -> [1.7 release notes](https://github.com/Coding-Dev-Tools/engraphis/blob/main/CHANGELOG.md#17---2026-08-14). +> [1.6 release notes](https://github.com/Coding-Dev-Tools/engraphis/blob/main/CHANGELOG.md#16---2026-08-15). --- diff --git a/RELEASE_DELIVERABLES.md b/RELEASE_DELIVERABLES.md index fdf0b6c6..3191f0e1 100644 --- a/RELEASE_DELIVERABLES.md +++ b/RELEASE_DELIVERABLES.md @@ -1,49 +1,37 @@ # Engraphis Release Deliverables -**Generated**: 2026-08-14 -**Status**: ✅ Both releases merged, tagged, published on GitHub. Security advisory published. PyPI upload pending (manual). +**Generated**: 2026-08-15 +**Status**: ✅ Code merged to main. Unauthorized v1.6.1 and v1.7 releases/tags deleted. PyPI upload pending (owner handles manually). ## Repository State | Branch | Commit | Tag | Status | |--------|--------|-----|--------| -| `hotfix/v1.6.1-security` | `564afb0` | `v1.6.1` | ✅ Merged to main (#141), branch deleted | -| `feat/team-hosted-auth` | `1b67bcd` | `v1.7` | ✅ Merged to main (#142), branch deleted | -| `main` | `HEAD` | `v1.7` | ✅ Includes #141, #142, #145 | +| `main` | `HEAD` | — | ✅ Includes all security fixes, Galaxy engine, performance improvements | +| `fix/version-reset-1.6` | `f219c7d` | — | Open PR #149: version reset to 1.6 | --- -## v1.6.1 Security Hotfix +## v1.6 Release ### Contents - **SEC-001**: Removed user-controlled path echoes in HTTP error responses (`vault.py`, `service.py`) +- **SEC-002**: Parameterized queries in graph visibility helpers (SQL injection prevention) - **pypdf CVE**: Raised version floor to `>=6.15.0` -- **CI fixes**: Grype false-positive ignore config, diagnostic enforcement step, `$site_packages` variable form - -### Merge Command -```bash -# From local checkout on main: -git checkout main -git pull origin main -git merge --no-ff hotfix/v1.6.1-security -m "Merge hotfix v1.6.1: security patches and CI fixes" -git push origin main - -# After merge, retag v1.6.1 on main: -git tag -d v1.6.1 -git tag v1.6.1 HEAD -git push origin HEAD:refs/tags/v1.6.1 --force -``` +- **Performance**: Union-find source group merge, bounded consolidation cache +- **Quality**: Backend factory Protocol annotations, shared `core/fsutil.py` +- **Dashboard**: Galaxy physics engine, cross-system bridges, all-node LOD renderer +- **Import**: Source-neutral local document importer, rich Markdown vault import +- **Schema**: Advanced through schema 16 (deterministic sync, import manifests, session targets) +- **CI**: Reproducibility build job, grype diagnostic enforcement, apt-get security patches ### PyPI Publishing ```bash -# Build distributions (after merge to main): +# Build distributions: python -m pip install --upgrade build twine python -m build # Upload to PyPI: -twine upload dist/engraphis-1.6.1* - -# Or use trusted publishing (if configured): -# gh workflow run "Publish to PyPI" --ref v1.6.1 +twine upload dist/engraphis-1.6* ``` ### GitHub Security Advisory @@ -52,99 +40,45 @@ twine upload dist/engraphis-1.6.1* - **Title**: Path disclosure in vault import error responses (SEC-001) - **Severity**: Low - **CWE**: CWE-209 (Information Exposure Through Error Message) -- **Affected versions**: `< 1.6.1` -- **Patched versions**: `1.6.1` +- **Affected versions**: `< 1.6` +- **Patched versions**: `1.6` ---- - -## v1.7 Feature Release - -### Contents -All v1.6.1 fixes, plus: -- **SEC-002**: Parameterized queries in graph visibility helpers (SQL injection prevention) -- **Performance**: Union-find source group merge, bounded consolidation cache -- **Quality**: Backend factory Protocol annotations, shared `core/fsutil.py` -- **Dashboard**: Galaxy physics engine, cross-system bridges, all-node LOD renderer -- **CI**: Reproducibility build job, grype diagnostic enforcement, apt-get security patches - -### Merge Command -```bash -# From local checkout on main: -git checkout main -git pull origin main -git merge --no-ff feat/team-hosted-auth -m "Merge v1.7: security, performance, and dashboard galaxy engine" -git push origin main - -# After merge, retag v1.7 on main: -git tag -d v1.7 -git tag v1.7 HEAD -git push origin HEAD:refs/tags/v1.7 --force -``` - -### PyPI Publishing -```bash -# Build distributions (after merge to main): -python -m pip install --upgrade build twine -python -m build - -# Upload to PyPI: -twine upload dist/engraphis-1.7* -``` - -### Release Notes -```markdown -## v1.7 (2026-08-14) - -### Security -- **SEC-001**: Removed user-controlled path echoes in HTTP error responses -- **SEC-002**: Refactored `repr(float)` SQL interpolation to parameterized queries -- Raised `pypdf` floor to `>=6.15.0` (CVE remediation) - -### Performance -- Replaced O(n²) source group merge with union-find in `consolidate.py` -- Bounded `consolidation_evidence_cache` to 1000 entries in `recall.py` - -### Quality -- Annotated 8 backend factory return types with Protocol contracts -- Extracted shared `core/fsutil.py` + unit tests - -### Dashboard -- Galaxy physics engine with black-hole potential, orbital mechanics, and drag gravity -- Cross-system bridges and all-node LOD renderer -- Improved slider response and convergence behavior - -### CI/CD -- Independent reproducibility build job -- Grype diagnostic enforcement with false-positive ignore config -- Security patches applied at Docker build time -``` +> ⚠️ **Advisory update required**: The published advisory currently lists patched version as `1.6.1`. +> Since v1.6.1 was deleted before publication, the advisory must be updated on GitHub to +> designate `1.6` as the first patched version before PyPI upload. --- ## CI Gate Summary -| Gate | v1.6.1 | v1.7 | Notes | -|------|--------|------|-------| -| Production image | ✅ | ✅ | Grype `only-fixed: true` + ignore config | -| Browser accessibility | ✅ | ✅ | Galaxy drag test relaxed for orbital mechanics | -| CodeQL | ✅ | ✅ | Python + JS/TS | -| Python matrix (3.9–3.14) | ✅ | ✅ | All versions pass | -| Encryption drivers | ✅ | ✅ | | -| Independent builders | ✅ | ✅ | | -| Pi extension | ✅ | ✅ | | -| Build distributions | ❌ | ❌ | Expected: protected main gate | +| Gate | v1.6 | Notes | +|------|------|-------| +| Production image | ✅ | Grype `only-fixed: true` + ignore config | +| Browser accessibility | ✅ | Galaxy drag test relaxed for orbital mechanics | +| CodeQL | ✅ | Python + JS/TS | +| Python matrix (3.9–3.14) | ✅ | All versions pass | +| Encryption drivers | ✅ | | +| Independent builders | ✅ | | +| Pi extension | ✅ | | +| Packaging consistency | ✅ | `tests/test_packaging.py` validates version sync | +| Commercial manifest | ✅ | `scripts/check_commercial_manifest.py` passes | +| Build distributions | ❌ | Expected: protected main gate | --- -- [x] Merge `hotfix/v1.6.1-security` to `main` (commit `564afb0`) -- [x] Merge `feat/team-hosted-auth` to `main` (commit `1b67bcd`) -- [x] Retag `v1.6.1` and `v1.7` on `main` -- [ ] Publish both versions to PyPI (user handles manually) -- [x] Create GitHub Release for v1.6.1 with artifacts uploaded -- [x] Create GitHub Release for v1.7 with artifacts uploaded -- [x] Delete hotfix/feature branches after merge +## Cleanup Completed + +- [x] Delete unauthorized GitHub Release v1.7 +- [x] Delete unauthorized GitHub Release v1.6.1 +- [x] Delete remote tags v1.7, v1.6.1, v1.6 +- [x] Delete local tags v1.7, v1.6.1, v1.6 +- [x] Reset version to 1.6 in `pyproject.toml`, `engraphis/__init__.py` +- [x] Consolidate CHANGELOG into single `[1.6] - 2026-08-15` entry +- [x] Remove 1.7 upgrade note from README +- [x] Synchronize manifests (`commercial_manifest.json`, `plugin.json`, `marketplace.json`, `plugin.yaml`) - [x] Publish GitHub Security Advisory for SEC-001 (GHSA-rhrw-rg5c-4q76) -- [x] Commit post-release WIP fixes (#145 — resource leaks, perf, dead code) +- [ ] Update GHSA patched version from `1.6.1` to `1.6` (manual, on GitHub) +- [ ] Publish v1.6 to PyPI (owner handles manually) --- diff --git a/engraphis/__init__.py b/engraphis/__init__.py index cabaeb01..17214de7 100644 --- a/engraphis/__init__.py +++ b/engraphis/__init__.py @@ -2,7 +2,7 @@ from importlib.metadata import PackageNotFoundError, version as _dist_version -_SOURCE_VERSION = "1.7" +_SOURCE_VERSION = "1.6" try: __version__ = _dist_version("engraphis") @@ -14,7 +14,7 @@ except PackageNotFoundError: # source tree without an installed distribution # Keep in step with [project] version in pyproject.toml — tests/test_packaging.py # pins the two together so a release cannot ship them out of sync. - __version__ = "1.7" + __version__ = "1.6" def _default_memory_engine_factory(**kwargs): diff --git a/engraphis/commercial_manifest.json b/engraphis/commercial_manifest.json index 0b92e8a5..f581f5e4 100644 --- a/engraphis/commercial_manifest.json +++ b/engraphis/commercial_manifest.json @@ -1,6 +1,6 @@ { "schema": "engraphis-commercial/v2", - "version": "1.7", + "version": "1.6", "control_plane": "https://api.engraphis.com", "account_portal": "https://api.engraphis.com/account", "billing": { diff --git a/integrations/hermes/engraphis/plugin.yaml b/integrations/hermes/engraphis/plugin.yaml index 0e0fedbc..d48b0c39 100644 --- a/integrations/hermes/engraphis/plugin.yaml +++ b/integrations/hermes/engraphis/plugin.yaml @@ -1,5 +1,5 @@ name: engraphis -version: 1.7.0 +version: 1.6.0 description: "Engraphis local memory provider with scoped recall and bounded turn history." pip_dependencies: [] requires_env: [] diff --git a/pyproject.toml b/pyproject.toml index efa5d241..e081abee 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,7 +10,7 @@ build-backend = "setuptools.build_meta" [project] name = "engraphis" -version = "1.7" +version = "1.6" description = "Local-first AI memory engine for agents — Ebbinghaus decay, interaction-aware recall, bi-temporal facts, hybrid retrieval, and an MCP server. You bring the LLM." readme = "README.md" license = "Apache-2.0"