Separate hosted commercial services and harden open-core boundaries#53
Conversation
- Cloud license leasing with Polar integration - Sync relay improvements for team mode - Inspector auth and webhook enhancements - Email outbox retention policies - HTTP security hardening - Dashboard v2 team audit capabilities - Release workflow improvements - Commercial manifest validation All tests passing (1606 passed, 14 skipped). Ruff clean.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 189f96cf86
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| """Read the cloud-authoritative managed-maintenance policy.""" | ||
| from engraphis.cloud_features import CloudFeatureClient | ||
|
|
||
| ws = _require_ws() |
There was a problem hiding this comment.
When an installation has multiple workspaces, these handlers always use _default_ws() via _require_ws() (the first listed workspace), while the dashboard's automation calls carry no workspace argument. Thus viewing, saving, or running automation after selecting another workspace silently reads, uploads, and schedules the first workspace instead of the selected one. Accept and propagate a workspace parameter (as the analytics route does) through the automation and maintenance calls.
AGENTS.md reference: AGENTS.md:L148-L149
Useful? React with 👍 / 👎.
1 participant
Summary
Why
The Public-GA adversarial audit found release-blocking cases where commercial implementation details remained in the open repository and where session-scoped or authenticated data could cross user, workspace, graph, snapshot, and sync boundaries. The principal root causes were inconsistent identity validation, legacy ownerless-session fallbacks in authenticated mode, insufficient filtering at off-device/export boundaries, and concurrency/idempotency assumptions that did not hold across processes.
This PR makes the public/private boundary explicit and fails closed at every authenticated or off-device boundary while preserving standalone local-owner compatibility.
Validation
All checks were run locally from commit
189f96c:python -m pytest tests/ -q -p no:cacheprovider— passedruff check .— passedpython -m eval.harness --dataset eval/datasets/sample.jsonl --k 5— recall@k, hit@k, and answer-token recall: 1.000python -m eval.harness --dataset eval/datasets/codemem.jsonl --k 5— recall@k, hit@k, and answer-token recall: 1.000python -m eval.ablation— standard recall@5: 1.0 for vector-only, hybrid-1hop, and hybrid-PPR; multi-hop graph arm: vector 0.6667, 1-hop 0.0, PPR 1.0uv build . --no-create-gitignore— wheel and sdist builtpython -m twine check <artifacts>— wheel and sdist passedpython scripts/verify_release_artifacts.py --version 1.0.0 --allow-subset --retries 1— passedpython scripts/check_commercial_manifest.py— passedgit diff --check, andorigin/mainancestry — passedGitHub Actions caveat
GitHub Actions may be blocked account-wide by the repository owner's billing or spending limit. Private PR #1 had its job rejected before any runner step for that account-level reason; that event was not a code/test failure. This draft should therefore rely on the local evidence above until hosted runners successfully start.