Consolidate Classic into Ledger and protect drafts and local APIs

.env.example

@@ -303,6 +303,11 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # http://localhost:<ENGRAPHIS_PORT>. Explicit values replace both loopback origins.
 # ENGRAPHIS_CORS_ORIGINS=https://myapp.example.com
 
+# Without ENGRAPHIS_API_TOKEN, the dashboard API and read-only graph server answer only
+# localhost, IP addresses, the bind host, the ENGRAPHIS_DASHBOARD_URL host and these extra
+# comma-separated names, so a website using DNS rebinding cannot reach them.
+# ENGRAPHIS_ALLOWED_HOSTS=engraphis.lan,my-desktop
+
 # Rate limiting: requests per window. Default: 0 (disabled), with a 60s window
 # used when ENGRAPHIS_RATE_LIMIT is set above zero.
 # ENGRAPHIS_RATE_LIMIT=0

.githooks/pre-commit

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Warn-only design-slop check for the Engraphis dashboard.
 #
-# Runs ONLY when engraphis/static/index.html is staged, and NEVER blocks the
+# Runs ONLY when engraphis/dashboard_assets/index.html is staged, and NEVER blocks the
 # commit — it prints a summary and always exits 0. Warn-only is deliberate: the
 # automated development workflows may commit, and a blocking hook would break
 # those unattended commits. For a hard gate on your own manual commits, run
@@ -12,9 +12,9 @@
 set -uo pipefail
 
 staged="$(git diff --cached --name-only 2>/dev/null || true)"
-printf '%s\n' "$staged" | grep -q 'engraphis/static/index\.html' || exit 0
+printf '%s\n' "$staged" | grep -q 'engraphis/dashboard_assets/index\.html' || exit 0
 
 if [ -f scripts/design-lint.sh ]; then
-  bash scripts/design-lint.sh engraphis/static/index.html || true
+  bash scripts/design-lint.sh engraphis/dashboard_assets/index.html || true
 fi
 exit 0

.github/workflows/codeql.yml

@@ -30,15 +30,15 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           config-file: ./.github/codeql/codeql-config.yml
           packs: ${{ matrix.language == 'python' && 'codeql/python-queries:AlertSuppression.ql' || 'codeql/javascript-queries:AlertSuppression.ql' }}
       - name: Analyze
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           output: codeql-results
           upload: never
@@ -50,7 +50,7 @@ jobs:
           python scripts/check_codeql_sarif.py --filter-approved
           "${{ steps.analyze.outputs.sarif-output }}" codeql-results-filtered
       - name: Upload CodeQL results
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           sarif_file: codeql-results-filtered
           category: ".github/workflows/codeql.yml:analyze/language:${{ matrix.language }}"

.github/workflows/release-pi.yml

@@ -84,7 +84,7 @@ jobs:
         with:
           node-version: "24"
           registry-url: https://registry.npmjs.org
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: pi-npm-package
           path: dist

.github/workflows/release.yml

@@ -213,17 +213,17 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Download primary distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: primary/
       - name: Download builder A
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: reproducibility-builder-a
           path: builder-a/
       - name: Download builder B
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: reproducibility-builder-b
           path: builder-b/
@@ -341,7 +341,7 @@ jobs:
         with:
           python-version: "3.9"
       - name: Download exact release distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
@@ -407,7 +407,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Download exact release distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
@@ -602,7 +602,7 @@ jobs:
           metadata.unlink()
           PY
       - name: Generate whole-image SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: engraphis:release
           format: cyclonedx-json
@@ -738,14 +738,14 @@ jobs:
         with:
           python-version: "3.11"
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           config-file: ./.github/codeql/codeql-config.yml
       - name: Analyze complete source tree
         id: analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4
         with:
           output: codeql-results
           upload: never
@@ -766,27 +766,27 @@ jobs:
         with:
           python-version: "3.11"
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
       - name: Download exact build environment evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: build-environment-evidence
           path: release-evidence/
       - name: Download whole-image evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: production-image-evidence
           path: release-evidence/
       - name: Download independent reproducibility evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: independent-reproducibility
           path: release-evidence/
       - name: Download complete installed journey evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: installed-journey-*
           path: installed-journey-inputs/
@@ -851,7 +851,7 @@ jobs:
         with:
           python-version: "3.11"
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
@@ -915,13 +915,13 @@ jobs:
         with:
           python-version: "3.11"
       - name: Download distributions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: python-package-distributions
           path: dist/
 
       - name: Download public release evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           name: public-release-evidence
           path: release-evidence/

AGENTS.md

@@ -28,7 +28,7 @@ most common mistake here.
 |---|---|---|
 | Status | Primary scoped, bi-temporal, interface-driven implementation. | Compatibility/reference implementation with flat namespaces. |
 | Model | Scoped + bi-temporal + typed; interface-driven. | Single flat `namespace` string per memory. |
-| Code | `engraphis/core/`, `engraphis/backends/`, `eval/`, `tests/`, `scripts/migrate_to_v2.py` | `engraphis/app.py`, `config.py`, `models.py`, `routes/`, `stores/`, `engines/`, `llm/`, `static/` |
+| Code | `engraphis/core/`, `engraphis/backends/`, `eval/`, `tests/`, `scripts/migrate_to_v2.py` | `engraphis/app.py`, `config.py`, `models.py`, `routes/`, `stores/`, `engines/`, `llm/` |
 | Data | new v2 schema (`SCHEMA_VERSION = 18`) | `engraphis_v1.db` |
 | Entry | `engraphis.MemoryEngine.create()` / `engraphis.create_memory_engine()` → `engraphis/factory.py` → `core/engine.py` | Internal reference only; never a public launcher |