Harden Cloud decisions and fix recent graph and release regressions

.github/workflows/ci.yml

@@ -235,13 +235,23 @@ jobs:
           python -m pip install -e ".[test]"
       - name: Install and verify the Pi package
         working-directory: integrations/pi
+        # Windows defaults to pwsh, which reports only the last command's exit code.
+        shell: bash
         env:
           ENGRAPHIS_PI_TEST_COMMAND: engraphis-mcp
         run: |
+          # npm 10 crashes while repairing a nested published shrinkwrap.
+          npm install --global --ignore-scripts npm@11.12.1
           npm ci --ignore-scripts
+          # The test host's published shrinkwrap overrides this package's nested pin.
+          # Repair that exact leaf in the installed host, preserving its other locked deps.
+          # --omit=dev excludes the host's own authoring tools, not this package's test tools.
+          npm install --prefix node_modules/@earendil-works/pi-coding-agent --ignore-scripts --no-save --omit=dev brace-expansion@5.0.12
+          node -e "require('node:assert/strict').equal(require('./node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion/package.json').version, '5.0.12')"
           npm run verify
           npm run test:integration
-          npm audit --omit=dev
+          npm audit
+          npm audit --no-package-lock --include=dev
 
   browser-accessibility:
     name: browser accessibility smoke
@@ -441,7 +451,9 @@ jobs:
           wheels = list(Path("dist").glob("*.whl"))
           assert len(wheels) == 1
           profile = os.environ["ENGRAPHIS_SMOKE_PROFILE"]
+          # Large server wheels can pause longer than pip's default socket timeout.
           subprocess.run([str(executable), "-m", "pip", "install",
+                          "--timeout", "120", "--retries", "5",
                           str(wheels[0].resolve()) + f"[{profile}]"], check=True)
           subprocess.run([str(executable), "-m", "pip", "check"], check=True)
           (root / "environment.lock").write_text(subprocess.check_output(

.github/workflows/release.yml

@@ -892,6 +892,11 @@ jobs:
 
   github-release:
     name: Publish GitHub Release
+    # Share one publication lock with repairs, including runs on other refs.
+    concurrency:
+      group: engraphis-github-release-publication
+      cancel-in-progress: false
+      queue: max
     needs: publish
     environment: release-qualification
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
@@ -953,6 +958,11 @@ jobs:
 
   github-release-repair:
     name: Repair GitHub Release
+    # Hold the lock from the Latest lookup through all GitHub release writes.
+    concurrency:
+      group: engraphis-github-release-publication
+      cancel-in-progress: false
+      queue: max
     environment: release-qualification
     if: >-
       github.event_name == 'workflow_dispatch' &&
@@ -1231,7 +1241,27 @@ jobs:
         run: |
           set -euo pipefail
           notes_args=()
+          latest_args=(--latest)
+          promote_latest=true
           if [ "$WAIVE_QUALIFICATION" = "true" ]; then
+            # A retained older repair must not displace a newer public Latest.
+            # Both authorized candidates already have a public release history;
+            # failed lookups or unknown tag formats stop before any release write.
+            current_latest="$(gh release view --repo "$GH_REPO" --json tagName --jq .tagName)"
+            promote_latest="$(python - "$RELEASE_TAG" "$current_latest" <<'PY'
+          import re
+          import sys
+
+          def version(tag):
+              if re.fullmatch(r"v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", tag) is None:
+                  raise SystemExit("Latest release comparison requires stable version tags")
+              return tuple(map(int, tag[1:].split(".")))
+
+          print("true" if version(sys.argv[1]) >= version(sys.argv[2]) else "false")
+          PY
+          )"
+            latest_args=(--latest=false)
+            if [ "$promote_latest" = "true" ]; then latest_args=(--latest); fi
             {
               printf '## Release qualification\n\n'
               printf 'The owner waived full-product qualification for this release. Mandatory full-product gates are not represented as passed.\n\n'
@@ -1254,7 +1284,7 @@ jobs:
             gh release upload "$RELEASE_TAG" verified-dist/* release-evidence/* \
               --repo "$GH_REPO" \
               --clobber
-            if [ "$WAIVE_QUALIFICATION" = "true" ]; then
+            if [ "$WAIVE_QUALIFICATION" = "true" ] && [ "$promote_latest" = "true" ]; then
               gh release edit "$RELEASE_TAG" --repo "$GH_REPO" --latest
             fi
           else
@@ -1264,5 +1294,5 @@ jobs:
               --generate-notes \
               "${notes_args[@]}" \
               --title "Engraphis ${RELEASE_TAG#v}" \
-              --latest
+              "${latest_args[@]}"
           fi

BENCHMARKS.md

@@ -94,14 +94,14 @@ interpretation and do not count as additional benchmark-quality gains.
 ### Public numeric evidence registry
 
 Every exact public aggregate retained below comes from the checked-in, public-safe
-[`offline-fixtures-v80.json`](docs/benchmark-evidence/offline-fixtures-v80.json) artifact. Its
+[`offline-fixtures-v88.json`](docs/benchmark-evidence/offline-fixtures-v88.json) artifact. Its
 SHA-256 is
-`ac63dac1e34c66b658eeb5846599ef42d774a5e212860b2a909941f364c82bc2`, also recorded in the
+`18af203925d9d53f77097b4459a30578b2d769a8bc9c7d224e7897f2a1b19199`, also recorded in the
 adjacent `.sha256` file. The artifact contains no raw questions, answers, prompts, customer data,
 or per-record content fingerprints.
 
 The fixture-suite digest is
-`431b525443f5b4875646e7f6470d107f584120bdd6ee7f53d0b6484d003fa0f7`. The artifact defines
+`f727d7ee767b9798cefac33bf7d82423e02aeaa52b1b7964341ee1222d3dff81`. The artifact defines
 the digest algorithm and records the SHA-256 of every suite and dataset file. Each evidence ID
 also binds its exact command through `sha256(UTF-8 exact command)`:
 
@@ -123,10 +123,10 @@ Historical LoCoMo, graph, handoff, consolidation, and security figures remain pr
 source artifacts but are omitted from the current chart until each has a matching immutable,
 public-safe artifact. The chart labels coding outcomes, external datasets, and operational
 capacity as pending evaluation tracks rather than implying scores. Regenerate it with
-`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v80.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
+`python scripts/render_benchmark_report.py --report docs/benchmark-evidence/offline-fixtures-v88.json --output docs/images/context-efficiency.svg` after selecting the report to publish.
 
 The companion examples are also generated from that artifact with
-`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v80.json --output docs/images/evidence-backed-agent-examples.svg`.
+`python -m scripts.render_benchmark_examples --report docs/benchmark-evidence/offline-fixtures-v88.json --output docs/images/evidence-backed-agent-examples.svg`.
 The historical-to-executable mapping is in
 [`docs/BENCHMARK_CHANGE_COVERAGE.md`](docs/BENCHMARK_CHANGE_COVERAGE.md).
 

CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Engraphis are documented here. Format loosely follows
 
 ## [Unreleased]
 
+- Updated the Pi extension's locked `fast-uri` to 3.1.8, `ip-address` to 10.7.2 and
+  `brace-expansion` to 5.0.12. CI repairs the Pi test host's embedded vulnerable leaf with
+  that exact pin, verifies the installed version, and audits both the full dependency lock
+  and installed tree. Pi checks use bash on Windows, so every install, build, test and audit
+  failure stops the job.
+- Updated the Pi test host to 0.87.1 to include the patched WebSocket client, and
+  extended the Pi dependency audit to cover its development dependencies.
+- Updated the Pi extension's locked `ip-address` dependency to 10.5.1, fixing
+  IPv6 link-local and NAT64 classification advisories without changing its dependency ranges.
+- Hardened the experimental Cloud decision client with validated destinations,
+  redirect refusal, bounded responses, strict decision parsing, and read-only
+  result interfaces. Loopback endpoints bypass proxies and reject external DNS
+  destinations. Managed availability and performance remain unverified.
+- Fixed the spacetime overlay's final paused frame being skipped by paint throttling.
+- Enforced a Cloud request deadline across connection retries, TLS, request sends,
+  proxy handshakes, slow headers, and chunk framing. Preserved HTTP 413 for streamed oversized read-only
+  requests across parser versions.
+- Prevented retained-release waiver repairs from replacing a newer GitHub Latest
+  release, with a shared publication queue to serialize GitHub release writes.
+- Reran the public offline fixtures into immutable v88 evidence and refreshed its
+  source bindings, documentation, and charts.
+
 ## [1.7.8] - 2026-09-27
 
 - Improved graph rendering and overlay scheduling, preserved saved Compact and custom

README.md

@@ -84,9 +84,9 @@ neither is an end-to-end question-answer score. Coding outcomes, external datase
 operational capacity remain separate pending evaluation tracks until their artifacts are selected.
 
 These values are evidence IDs `offline-chunking` and `offline-performance` in
-[`offline-fixtures-v80.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v80.json),
+[`offline-fixtures-v88.json`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/docs/benchmark-evidence/offline-fixtures-v88.json),
 SHA-256
-`ac63dac1e34c66b658eeb5846599ef42d774a5e212860b2a909941f364c82bc2`.
+`18af203925d9d53f77097b4459a30578b2d769a8bc9c7d224e7897f2a1b19199`.
 [`BENCHMARKS.md`](https://github.com/Coding-Dev-Tools/engraphis/blob/main/BENCHMARKS.md#public-numeric-evidence-registry)
 records the matching suite digest, exact commands, and per-command config digests. The offline
 fixture registry intentionally excludes external, model-dependent, consolidation, productivity,

docs/HOSTED_PLANS.md

@@ -28,5 +28,14 @@ The email-confirmed, no-card trial lasts three active days for Pro and ten activ
 24 hours. It does not extend a trial or subscription, grant cloud access, or affect the free
 local tools. `recovery_read_only` supports hosted account recovery and export after grace.
 
+## Experimental decision adapter
+
+The source includes an opt-in Jev advisory adapter and a client for the experimental
+`POST /v1/jev/decide` Cloud endpoint. It is not connected to core memory writes or
+grounded recall. Callers supply a client and pinned model and explicitly authorize
+each remote request; offline mode keeps these calls local by declining the request.
+Managed availability, plan entitlements, quotas, latency, and savings require separate
+service verification and are not established by this client implementation.
+
 See [Licensing and commercial service boundary](LICENSING.md) for the full source and service
 boundary, and [Cloud Sync](SYNC.md) for the sync security model.