feat: Engraphis 1.7 release — full changeset (#186)

* fix(integrations): default SessionStart hook to terse 300-char context

The 1500-char prose context was actively harmful on Qwen 3.7 Flash
(bench_v1/V12: -0.067 substring score vs no-memory baseline) and only
marginally helpful on larger models. Smaller models get distracted
by dense technical context and lose focus on the actual question.

Switch the default to a 300-char "[n] first-sentence" compression
of the upstream MCP context. The compression prefers the explicit
"[n]" markers that engraphis_session already emits; falls back to
period-splitting for unnumbered prose. Always fails open: returns
the original context unchanged on any parse failure.

Users who want the original 1500-char prose can opt in with
ENGRAPHIS_HOOK_FORMAT=prose. Tests cover both modes, the env
override, the fail-open behaviour, and the per-fact budget cap.

19/19 tests pass (10 existing + 9 new). ruff check clean.

* fix(graph): restore correct Line-width range in the classic dashboard slider

The classic dashboard shipped a `data-graph-scale="10"` attribute on the
Line-width slider that multiplied the displayed value by 10 (min="2" max="45")
but never divided it back before reaching the engine. Picking the
`communities` preset put `linkw=7.2` into the engine, which renders edges at
`0.82 * 7.2 ~= 5.9` pixels - ten times thicker than the
`GRAPH_PRESETS.communities.linkw = 0.72` the engine was designed for.

The Ledger already ships the raw range (min="0.1" max="2" step="0.01") and a
0.72 default, so the classic dashboard now matches it. Removing the
`data-graph-scale` keeps the round-trip lossless: the slider value the user
sees is the value the engine receives.

A regression test parses `GRAPH_PRESETS` from `classic_assets/dashboard.js`,
asserts each preset's `linkw` is reachable on the slider, and asserts the
`data-graph-scale` attribute never re-appears on the `linkw` input.

Cache busters on the served CSS/JS bumped to v=20260902-classic-linkw-slider-1.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

* feat: Engraphis 1.7 release — full changeset

Version 1.7 across pyproject.toml, __init__.py, commercial_manifest.json,
marketplace.json, plugin.json, and CHANGELOG.md.

Core changes: semantic_confidence_calibration default True,
ProfileConfig arm_candidate_k_default=200, graph_seed_fallback opt-in,
store id-kind whitelist with allow_unsafe escape hatch, tightened
valid_to<=valid_from with quarantine-marker exception, scored LIKE
fallback, audit hash-chain prev_hash + AUDIT_ACTORS, per-version
schema_migrations, secure_erase_impact, _CAPABILITY_INDEX TTL/LRU,
MCP confirmed attestation for destructive tools, CLI --workspace alias.

Includes 7 new release test files, grounded distractor dataset,
and .gitignore fix for dashboard_slider_test.png.

All 12 CI/eval gates verified: ruff clean, pyright 0 errors,
pytest all pass, eval harness/ablation/reinforcement/adversarial/
grounded/code_arm all PASS.

* fix(pi): bump fast-uri to 3.1.7 and qs to 6.16.0 in shrinkwrap

CI's `npm audit --omit=dev` gate fails on fast-uri 3.1.5 (GHSA-5jgf-p345-68v8,
GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp — high) and
qs 6.15.3 (moderate). `npm audit fix --package-lock-only` moves fast-uri to
3.1.7 and qs to 6.16.0 with no API change; verify+integration suites pass
locally (21/21) and audit now reports 0 vulnerabilities.

* docs: clarify dashboard import wizard zero-token loopback behavior

---------

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

Author: Coding-Dev-Tools

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.6"
+      "version": "1.7"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.6",
+  "version": "1.7",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,6 +1,6 @@
-4c18cdb509babb853ac7e5283ca9b309e2669b82ff098f3acf33238a9e4c1114  .claude-plugin/marketplace.json
-94bfa06317a8fe6a6a7e204bb70c5abdc9e4bbc34d79dd6f8447a30140bc8b85  .claude-plugin/plugin.json
+cfff3064e31d0547e990f325d26fc172397d2d7b453230d5d52aebc7ea3cc79b  .claude-plugin/marketplace.json
+02259d5c35da8c46aac9891655ae3623fc9cb4002aa65d429435714319999745  .claude-plugin/plugin.json
+4bc8979b9ffeb97190960e551dbf4ddc6f7aeeb7b86894fd2298a59ff0001efa  skills/engraphis-memory/SKILL.md
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
-fcb5b4d939bda7d18e4b75c0e9106df4240aa7f8eabe8218e4e41f0038fa3df8  skills/engraphis-memory/references/TOOLS.md
-0f98098df695b9a00dc78402911124ebf09a4a058f6c8bec2c6234ec61fac13a  skills/engraphis-memory/SKILL.md
+d65721c1cc29faf975138a99f07bdee29ac49a9bc64b0737001781abc14407be  skills/engraphis-memory/references/TOOLS.md

.env.example

@@ -7,6 +7,9 @@
 # ── Server ──────────────────────────────────────────────────────────────────
 ENGRAPHIS_HOST=127.0.0.1
 ENGRAPHIS_PORT=8700
+# Port precedence for the dashboard bind: a platform-injected $PORT (Railway/Fly/Heroku)
+# wins over ENGRAPHIS_PORT; local and Compose runs without $PORT use ENGRAPHIS_PORT.
+# Docker Compose pins both PORT and ENGRAPHIS_PORT to ENGRAPHIS_COMPOSE_PORT (below).
 # The public package supports only customer mode: dashboard, memory, and managed-service
 # clients. Hosted vendor, relay, compute, and worker roles are not distributed here.
 ENGRAPHIS_SERVICE_MODE=customer

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
 
       - name: Full release gate
         run: |
-          python scripts/check_commercial_manifest.py
+          if [ -d website ]; then python scripts/check_commercial_manifest.py --website-root website; else python scripts/check_commercial_manifest.py; fi
           python scripts/externalize_dashboard_assets.py
           ruff check .
           pyright

.gitignore

@@ -88,6 +88,9 @@ internal/
 # tracked _smoke*.mjs / _measure_*.mjs must be removed with `git rm` (see audit handoff).
 /_*.mjs
 
+# Generated screenshot from tools/manual_slider_test.js — throwaway test artifact.
+/dashboard_slider_test.png
+
 # Local machine-specific launchers (absolute user paths / PM2 deploy specifics — not portable)
 /Start-Engraphis-Dashboard.bat
 /Engraphis Dashboard.lnk

BENCHMARKS.md

@@ -3,7 +3,7 @@
 All notable changes to Engraphis are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/); versions use SemVer.
 
-## [Unreleased]
+## [1.7] - 2026-09-03
 
 ### Added
 
@@ -200,10 +200,10 @@ All notable changes to Engraphis are documented here. Format loosely follows
   the matching `RecallEngine(arm_candidate_k_cap=...)` constructor argument) that clamps both
   the first-page widening (`candidate_k + min(250, candidate_k*3)`) and the second-page
   ceiling, so operators can trade untrusted-scope widening for latency on the new k=50
-  default without code changes. The accompanying benchmark test,
-  `test_recall_arm_candidate_k_cap.py`, uses a 300-fact trusted corpus because both requested
-  arm depths clamp to the same 49 rows on a smaller corpus and the timing assertion was
-  unreliable. Default behaviour is unchanged.
+  default without code changes. The accompanying benchmark test,
+  `test_recall_arm_candidate_k_cap.py`, uses a 300-fact trusted corpus because both requested
+  arm depths clamp to the same 49 rows on a smaller corpus and the timing assertion was
+  unreliable. Default behaviour is unchanged.
 - Import previews now page the source manifest exactly like execution, so vaults whose manifest
   outgrew one list page (10k identities) no longer show manifest-only files as silently absent
   from the preview plan; beyond-boundary rows are reported as `missing` instead of dropped.