Prepare 1.7.9 with managed Jev, workspace routing, and graph fixes

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.7.8"
+      "version": "1.7.9"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.7.8",
+  "version": "1.7.9",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,6 +1,6 @@
-df65a383a1ff80572fb6ebd9a807dca6d1ffc0f99f373971262de035b8e3622d  .claude-plugin/marketplace.json
-a03b5c38d836651d2c5c52173d21a5adeacfbbc4b80aac991c2154b6e060e174  .claude-plugin/plugin.json
-4bc8979b9ffeb97190960e551dbf4ddc6f7aeeb7b86894fd2298a59ff0001efa  skills/engraphis-memory/SKILL.md
+c1d184247775c8b3bf4d3f185d54fcac983aca8c54638a05d85b21e20db3ae7c  .claude-plugin/marketplace.json
+c5d0c26f28c9ee14092f9deaf24c98dd8bef49d971fef2b7a537ffb1ab9f2887  .claude-plugin/plugin.json
+aeee7a94671ceb306fe2d24c5acc9f2d96ad8a8e7410536566799eea6265f080  skills/engraphis-memory/SKILL.md
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
-62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
-9e5f1c8e91ca5697e828ab9e468504b8e1aa28e34f61307c9fcd850969126be9  skills/engraphis-memory/references/TOOLS.md
+9d090a03f5b3f36a34d91f66b72c3844591f6915755ac3a6c6ba5f1b16977de5  skills/engraphis-memory/references/SCOPING.md
+07de31349fc135895377cfcf852c490f732c19e83a627c311d724c5d2146dbb5  skills/engraphis-memory/references/TOOLS.md

.env.example

@@ -138,6 +138,22 @@ ENGRAPHIS_RETENTION_SUPERVISOR=none
 # ENGRAPHIS_GRAPH_HOST=127.0.0.1
 # ENGRAPHIS_GRAPH_PORT=8720
 
+# ── System 1 Decision Gating (TypeSafe AI Jev) ───────────────────────────
+# Advisory typed decisions for command screening and evidence assessment.
+# Default none/local sends no requests; each remote call needs allow_remote=true.
+# Pro & Team include a managed allowance when enabled by the service (no personal key needed).
+# For BYOK, enter the key at a hidden prompt and pipe it directly to the CLI:
+# python -c "import getpass,warnings; warnings.simplefilter('error',getpass.GetPassWarning); print(getpass.getpass('TypeSafe API key: '))" | engraphis-init --jev-key -
+# The key stays out of shell history and process arguments. If hidden input is
+# unavailable, the prompt fails instead of accepting visible input.
+# Community/BYOK users can set their own TypeSafe API key:
+# TYPESAFE_API_KEY=
+# JEV_API_KEY=
+# TYPESAFE_BASE_URL=https://api.typesafe.ai
+# ENGRAPHIS_DECISION_BACKEND=none  # none | local | managed | auto | byok
+# ENGRAPHIS_DECISION_MODEL=jev-1.13.0
+
+
 # Standalone MCP-over-HTTP server (`engraphis-mcp-http`). Loopback-only by default;
 # any non-loopback bind (via these or ENGRAPHIS_HOST) requires ENGRAPHIS_API_TOKEN.
 # ENGRAPHIS_HTTP_HOST=127.0.0.1
@@ -180,7 +196,7 @@ ENGRAPHIS_RETENTION_SUPERVISOR=none
 ENGRAPHIS_LLM_PROVIDER=openai
 # Model name (provider-specific):
 #   openai:      gpt-4o-mini, gpt-4o, gpt-4.1-mini, o4-mini ...
-#   anthropic:   claude-3-5-haiku-20241022, claude-3-5-sonnet-20241022 ...
+#   anthropic:   claude-sonnet-5-5, claude-opus-5-5, claude-haiku-4-5 ...
 #   google:      gemini-1.5-flash, gemini-2.0-flash ...
 #   openrouter:  anthropic/claude-3.5-sonnet, openai/gpt-4o-mini ...
 #   custom:      any model name your OpenAI-compatible endpoint accepts
@@ -194,6 +210,9 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # ENGRAPHIS_LLM_BASE_URL=https://openrouter.ai/api/v1
 # Optional: extra headers (JSON string) for custom providers.
 # ENGRAPHIS_LLM_EXTRA_HEADERS={"HTTP-Referer":"https://myapp.com","X-Title":"engraphis"}
+# Optional: reasoning effort (low|medium|high|xhigh|max) for Claude models that think by
+# default (Opus 5+, Sonnet 5+, Fable). Default medium; ignored by other providers and models.
+# ENGRAPHIS_LLM_EFFORT=medium
 
 # ── Hosted Pro / Team customer client ───────────────────────────────────────
 # Cloud Sync, Analytics, Automation, Auto Dreaming, Auto Consolidation, and Team
@@ -253,7 +272,7 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # ENGRAPHIS_STATE_DIR=/data/.engraphis
 
 # The private control plane may report ``workspace_write_grace`` for already-authorized
-# hosted-account continuity, capped at 24 hours. It never extends the exact 3-day trial,
+# hosted-account continuity, capped at 24 hours. It never extends the 7-day Pro or 14-day Team trial,
 # subscription expiry, or cloud access, and it never restricts the free local core.
 
 # Managed compute consent is decided automatically and needs no customer action: a

.github/workflows/ci.yml

@@ -235,13 +235,23 @@ jobs:
           python -m pip install -e ".[test]"
       - name: Install and verify the Pi package
         working-directory: integrations/pi
+        # Windows defaults to pwsh, which reports only the last command's exit code.
+        shell: bash
         env:
           ENGRAPHIS_PI_TEST_COMMAND: engraphis-mcp
         run: |
+          # npm 10 crashes while repairing a nested published shrinkwrap.
+          npm install --global --ignore-scripts npm@11.12.1
           npm ci --ignore-scripts
+          # The test host's published shrinkwrap overrides this package's nested pin.
+          # Repair that exact leaf in the installed host, preserving its other locked deps.
+          # --omit=dev excludes the host's own authoring tools, not this package's test tools.
+          npm install --prefix node_modules/@earendil-works/pi-coding-agent --ignore-scripts --no-save --omit=dev brace-expansion@5.0.12
+          node -e "require('node:assert/strict').equal(require('./node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion/package.json').version, '5.0.12')"
           npm run verify
           npm run test:integration
-          npm audit --omit=dev
+          npm audit
+          npm audit --no-package-lock --include=dev
 
   browser-accessibility:
     name: browser accessibility smoke
@@ -441,7 +451,9 @@ jobs:
           wheels = list(Path("dist").glob("*.whl"))
           assert len(wheels) == 1
           profile = os.environ["ENGRAPHIS_SMOKE_PROFILE"]
+          # Large server wheels can pause longer than pip's default socket timeout.
           subprocess.run([str(executable), "-m", "pip", "install",
+                          "--timeout", "120", "--retries", "5",
                           str(wheels[0].resolve()) + f"[{profile}]"], check=True)
           subprocess.run([str(executable), "-m", "pip", "check"], check=True)
           (root / "environment.lock").write_text(subprocess.check_output(

.github/workflows/codeql.yml

@@ -4,7 +4,8 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+    # Stacked PRs must receive the same security gate before reaching main.
+    branches: [main, "codex/**"]
   schedule:
     - cron: "23 4 * * 1"
 

.github/workflows/release.yml

@@ -892,6 +892,11 @@ jobs:
 
   github-release:
     name: Publish GitHub Release
+    # Share one publication lock with repairs, including runs on other refs.
+    concurrency:
+      group: engraphis-github-release-publication
+      cancel-in-progress: false
+      queue: max
     needs: publish
     environment: release-qualification
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
@@ -953,6 +958,11 @@ jobs:
 
   github-release-repair:
     name: Repair GitHub Release
+    # Hold the lock from the Latest lookup through all GitHub release writes.
+    concurrency:
+      group: engraphis-github-release-publication
+      cancel-in-progress: false
+      queue: max
     environment: release-qualification
     if: >-
       github.event_name == 'workflow_dispatch' &&
@@ -1231,7 +1241,27 @@ jobs:
         run: |
           set -euo pipefail
           notes_args=()
+          latest_args=(--latest)
+          promote_latest=true
           if [ "$WAIVE_QUALIFICATION" = "true" ]; then
+            # A retained older repair must not displace a newer public Latest.
+            # Both authorized candidates already have a public release history;
+            # failed lookups or unknown tag formats stop before any release write.
+            current_latest="$(gh release view --repo "$GH_REPO" --json tagName --jq .tagName)"
+            promote_latest="$(python - "$RELEASE_TAG" "$current_latest" <<'PY'
+          import re
+          import sys
+
+          def version(tag):
+              if re.fullmatch(r"v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", tag) is None:
+                  raise SystemExit("Latest release comparison requires stable version tags")
+              return tuple(map(int, tag[1:].split(".")))
+
+          print("true" if version(sys.argv[1]) >= version(sys.argv[2]) else "false")
+          PY
+          )"
+            latest_args=(--latest=false)
+            if [ "$promote_latest" = "true" ]; then latest_args=(--latest); fi
             {
               printf '## Release qualification\n\n'
               printf 'The owner waived full-product qualification for this release. Mandatory full-product gates are not represented as passed.\n\n'
@@ -1254,7 +1284,7 @@ jobs:
             gh release upload "$RELEASE_TAG" verified-dist/* release-evidence/* \
               --repo "$GH_REPO" \
               --clobber
-            if [ "$WAIVE_QUALIFICATION" = "true" ]; then
+            if [ "$WAIVE_QUALIFICATION" = "true" ] && [ "$promote_latest" = "true" ]; then
               gh release edit "$RELEASE_TAG" --repo "$GH_REPO" --latest
             fi
           else
@@ -1264,5 +1294,5 @@ jobs:
               --generate-notes \
               "${notes_args[@]}" \
               --title "Engraphis ${RELEASE_TAG#v}" \
-              --latest
+              "${latest_args[@]}"
           fi

BENCHMARKS.md

@@ -94,14 +94,14 @@ interpretation and do not count as additional benchmark-quality gains.
 ### Public numeric evidence registry
 
 Every exact public aggregate retained below comes from the checked-in, public-safe
-[`offline-fixtures-v80.json`](docs/benchmark-evidence/offline-fixtures-v80.json) artifact. Its
+[`offline-fixtures-v128.json`](docs/benchmark-evidence/offline-fixtures-v128.json) artifact. Its
 SHA-256 is
-`ac63dac1e34c66b658eeb5846599ef42d774a5e212860b2a909941f364c82bc2`, also recorded in the
+`73f2d1a8cd6e2db070577582a2266f6605efc052800da17db9938f7a274bf755`, also recorded in the
 adjacent `.sha256` file. The artifact contains no raw questions, answers, prompts, customer data,
 or per-record content fingerprints.
 
 The fixture-suite digest is
-`431b525443f5b4875646e7f6470d107f584120bdd6ee7f53d0b6484d003fa0f7`. The artifact defines
+`6e1be135db67964cfb48a2125ac846a9a420662b69ed4d7f61c21d1c87d971b2`. The artifact defines
 the digest algorithm and records the SHA-256 of every suite and dataset file. Each evidence ID
 also binds its exact command through `sha256(UTF-8 exact command)`:
 
@@ -123,10 +123,10 @@ Historical LoCoMo, graph, handoff, consolidation, and security figures remain pr
 source artifacts but are omitted from the current chart until each has a matching immutable,
 public-safe artifact. The chart labels coding outcomes, external datasets, and operational
 capacity as pending evaluation tracks rather than implying scores. Regenerate it with
-`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v80.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
+`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v128.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
 
 The companion examples are also generated from that artifact with
-`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v80.json --output docs/images/evidence-backed-agent-examples.svg`.
+`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v128.json --output docs/images/evidence-backed-agent-examples.svg`.
 The historical-to-executable mapping is in
 [`docs/BENCHMARK_CHANGE_COVERAGE.md`](docs/BENCHMARK_CHANGE_COVERAGE.md).