feat: Galaxy v6 physics engine, graph scene overhaul, and ledger UI improvements

.claude-plugin/skill-assets.sha256

@@ -2,5 +2,5 @@
 94bfa06317a8fe6a6a7e204bb70c5abdc9e4bbc34d79dd6f8447a30140bc8b85  .claude-plugin/plugin.json
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
-4ce83a2768680ec84488a767fc3bd6cd62688d785010a0abd1d4b3edbf14d03a  skills/engraphis-memory/references/TOOLS.md
-605181000a20a808e570b00cd2e852561f21234f041db03ade73f533b0e8bdaf  skills/engraphis-memory/SKILL.md
+96c8e9b9cee1b3cb43c4bef9e48c57ed92af707f7f7a5d28d73b1ac247d2f0c6  skills/engraphis-memory/references/TOOLS.md
+0f98098df695b9a00dc78402911124ebf09a4a058f6c8bec2c6234ec61fac13a  skills/engraphis-memory/SKILL.md

.dockerignore

@@ -63,3 +63,6 @@ playwright-report
 *.log
 *.whl
 *.tar.gz
+# Test suites and evaluation harnesses — not needed in production images.
+tests/
+eval/

.env.example

@@ -321,9 +321,6 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # rerankers when ENGRAPHIS_REQUIRE_IMMUTABLE_MODELS=1.
 # ENGRAPHIS_RERANK_REVISION=<lowercase 40-character model commit>
 
-# Workspace allow-list: comma-separated names. Empty = all allowed.
-# ENGRAPHIS_WORKSPACES=acme,personal
-
 # Cloud Sync relay: endpoint and optional token for self-hosted relay.
 # ENGRAPHIS_RELAY_URL=https://relay.example.com
 # ENGRAPHIS_SYNC_TOKEN=

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ jobs:
   test:
     name: test + lint (full offline stack)
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -51,6 +52,7 @@ jobs:
   typecheck:
     name: core + backends typecheck (Python 3.11)
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -68,6 +70,7 @@ jobs:
   encryption:
     name: encryption driver gate (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -94,6 +97,7 @@ jobs:
   core-py39:
     name: core floor (numpy-only, Python 3.9)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -161,6 +165,7 @@ jobs:
   coverage:
     name: coverage gate (Python 3.11)
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -178,6 +183,7 @@ jobs:
   hygiene:
     name: repo hygiene gate (no stray DBs/logs)
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Reject stray runtime artifacts at repo root
@@ -192,6 +198,7 @@ jobs:
   pi-extension:
     name: Pi extension (${{ matrix.os }}, Python ${{ matrix.python-version }}, Node ${{ matrix.node-version }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
@@ -229,6 +236,7 @@ jobs:
   browser-accessibility:
     name: browser accessibility smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -254,6 +262,7 @@ jobs:
     # pyproject.toml, or this workflow). No third-party actions — plain git diff.
     name: docker smoke — path gate
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     outputs:
       run: ${{ steps.decide.outputs.run }}
     steps:
@@ -274,6 +283,7 @@ jobs:
   docker-smoke:
     name: docker build + health smoke
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: docker-gate
     if: needs.docker-gate.outputs.run == 'true'
     steps:
@@ -312,7 +322,8 @@ jobs:
           trap cleanup EXIT
           python -m pip install --disable-pip-version-check --no-cache-dir pip-audit==2.10.1
           docker create --name "$container" engraphis:ci >/dev/null
-          docker cp "$container":/usr/local/lib/python3.11/site-packages/. "$audit_dir"
+          site_packages=$(docker run --rm engraphis:ci python3 -c "import sysconfig; print(sysconfig.get_path('purelib'))")
+          docker cp "$container:$site_packages/." "$audit_dir"
           python -m pip_audit --path "$audit_dir"
       - name: Run container (offline deterministic embedder — no model downloads)
         run: |
@@ -343,6 +354,7 @@ jobs:
   build:
     name: build + install wheel
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

.github/workflows/release.yml

@@ -19,6 +19,7 @@ jobs:
   build:
     name: Build distributions
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     if: >-
       github.event_name == 'push' ||
       inputs.release_tag == ''
@@ -151,6 +152,7 @@ jobs:
   reproducibility-build:
     name: Independent distribution builder ${{ matrix.builder }}
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     container: python:3.11-slim@sha256:90744cff8f32887f075c47d747a173ff333e9e98801667af93c357fa9f5e28ff
     if: >-
       github.event_name == 'push' ||
@@ -188,6 +190,7 @@ jobs:
     name: Compare independent distribution builders
     needs: [build, reproducibility-build]
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: >-
       github.event_name == 'push' ||
       inputs.release_tag == ''
@@ -279,6 +282,7 @@ jobs:
   python-matrix:
     name: Python ${{ matrix.python-version }} release gate
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
@@ -320,6 +324,7 @@ jobs:
       github.event_name == 'push' ||
       inputs.release_tag == ''
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
@@ -372,6 +377,7 @@ jobs:
   installed-artifact-platform-smoke:
     name: Installed wheel smoke (${{ matrix.os }})
     needs: build
+    timeout-minutes: 20
     runs-on: ${{ matrix.os }}
     if: >-
       github.event_name == 'push' ||
@@ -423,6 +429,7 @@ jobs:
 
   encryption:
     name: Encryption driver release gate (Python ${{ matrix.python-version }})
+    timeout-minutes: 15
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -447,6 +454,7 @@ jobs:
 
   browser-accessibility:
     name: Browser accessibility release gate
+    timeout-minutes: 20
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'push' ||
@@ -472,6 +480,7 @@ jobs:
 
   pi-extension:
     name: Pi extension release gate
+    timeout-minutes: 20
     runs-on: ubuntu-latest
     if: >-
       github.event_name == 'push' ||
@@ -503,6 +512,7 @@ jobs:
   docker-smoke:
     name: Production image release gate
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     if: >-
       github.event_name == 'push' ||
       inputs.release_tag == ''
@@ -609,7 +619,8 @@ jobs:
           trap cleanup EXIT
           python -m pip install --disable-pip-version-check --no-cache-dir pip-audit==2.10.1
           docker create --name "$container" engraphis:release >/dev/null
-          docker cp "$container":/usr/local/lib/python3.11/site-packages/. "$audit_dir"
+          site_packages=$(docker run --rm engraphis:release python3 -c "import sysconfig; print(sysconfig.get_path('purelib'))")
+          docker cp "$container:$site_packages/." "$audit_dir"
           python -m pip_audit --path "$audit_dir"
       - name: Run customer-mode readiness smoke
         shell: bash
@@ -618,6 +629,7 @@ jobs:
             -e ENGRAPHIS_EMBED_MODEL= \
             -e ENGRAPHIS_LOOP_INTERVAL=0 \
             -e ENGRAPHIS_HOST=0.0.0.0 \
+            -e ENGRAPHIS_SERVICE_MODE=customer \
             engraphis:release
           for i in $(seq 1 60); do
             if curl -fsS http://127.0.0.1:8700/api/ready; then
@@ -642,6 +654,7 @@ jobs:
       github.event_name == 'push' ||
       inputs.release_tag == ''
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     permissions:
       contents: read
     env:
@@ -675,6 +688,7 @@ jobs:
     needs: [build, reproducibility-check, python-matrix, artifact-core-py39, installed-artifact-platform-smoke, encryption, browser-accessibility, pi-extension, docker-smoke, code-security]
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: read
 
@@ -752,6 +766,7 @@ jobs:
     # semver tag, whose value was matched to pyproject.toml in the build job above.
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       id-token: write
       contents: read
@@ -798,6 +813,7 @@ jobs:
     needs: publish
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       contents: write
 
@@ -843,6 +859,7 @@ jobs:
       github.ref == 'refs/heads/main' &&
       inputs.release_tag != ''
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       actions: read
       contents: write

.gitignore

@@ -7,6 +7,11 @@ __pycache__/
 *.db-shm
 *.db-journal
 *.db.*.bak
+*.sqlite
+*.sqlite3
+*.sqlite-wal
+*.sqlite-shm
+*.sqlite-journal
 
 # Webhook fulfillment runtime state — dedup DB + the undelivered-key fallback,
 # which can contain live license keys. Must never be committed.
@@ -28,6 +33,9 @@ build/
 /engraphis-[0-9]*/
 .pytest_cache/
 /.pytest-*-tmp/
+# Focused UI/API test runs use named repository-local base directories.
+/.pytest-tmp-ui-*/
+/.codex-pytest-tmp/
 .ruff_cache/
 .coverage
 node_modules/

AGENTS.md

@@ -244,6 +244,26 @@ These are pure, unit-tested functions — change them only with a corresponding
   re-verify with `wc -l`/`grep` before trusting a test run against it; clearing `__pycache__`
   alone does not fix this (the staleness is in the source, not in cached bytecode).
 
+### PR delivery protocol for automated maintenance
+
+When an agent is maintaining an open pull request, the matching PR branch or an isolated
+worktree is the delivery boundary:
+
+1. Implement every attributable, safe, scoped review or CI fix in that matching branch or
+   worktree. After tests and lint pass, inspect `git status` and the complete diff, then commit
+   and push every clean, attributable fix and PR worktree file with an ordinary non-force push.
+   A verified fix must not be left only in a local checkout.
+2. Keep unrelated user edits, ambiguous files, credentials, generated databases, logs, and
+   secrets out of the PR. Preserve ambiguous work in its original checkout or a separate
+   worktree and report the exact separation needed; never mix it into an otherwise clean PR.
+3. After each push, recheck the remote CI/workflow results, logs, and current review threads.
+   Continue with safe, attributable iterations until the PR is merge-ready, and report exact
+   files, commits, tests, remaining review items, and blockers.
+4. Never force-push, merge, deploy, publish, delete branches/files, change credentials, rerun
+   workflows, post GitHub comments, resolve review threads, or send external messages without
+   explicit approval. Merge remains prohibited unless the user explicitly approves it, even
+   when checks are green.
+
 ---
 
 ## 7. Source-of-truth docs