fix(review): 16-agent release-readiness review and hardening

.claude-plugin/skill-assets.sha256

@@ -1,6 +1,6 @@
 d30ad152dcc4c82ce10e7167fdfe67e709358e5f435293939125f2d6cffc5b7e  .claude-plugin/marketplace.json
 28dcd15a7a186f8cb8a15705f1bd7734086167991c4acc28ec2cfea59a2374ab  .claude-plugin/plugin.json
-45dd73ca6afdd9e12ecd38c48e4a612b7646c25a07a75a80ca0e68d0e0b85f0e  skills/engraphis-memory/references/CONVENTIONS.md
-529fff3bdbe73f83209087fd10055fad77c5e5224ad8a9e6b0254052aa50e109  skills/engraphis-memory/references/SCOPING.md
-b2489b60159655e7e564e234d5aff24ba4d8df7cb82626edeaaaf89264007f85  skills/engraphis-memory/references/TOOLS.md
-56be8d078a2a8fc6e6cd1c2be5716605d8621dab953caa8cfcd20e2dce474305  skills/engraphis-memory/SKILL.md
+055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
+62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md
+4ce83a2768680ec84488a767fc3bd6cd62688d785010a0abd1d4b3edbf14d03a  skills/engraphis-memory/references/TOOLS.md
+605181000a20a808e570b00cd2e852561f21234f041db03ade73f533b0e8bdaf  skills/engraphis-memory/SKILL.md

.env.example

@@ -1,7 +1,8 @@
 # ── Engraphis Configuration ──────────────────────────────────────────
-# Copy this file to .env and edit only the settings you need. Commented values preserve
-# the platform-aware defaults in engraphis/config.py; hosted deployments additionally
-# require the authentication and public-URL settings described below.
+# Put the settings you need in the owner-private `~/.engraphis/config.env` created by
+# `engraphis-init`, or export them in the process environment. To select another file,
+# export ENGRAPHIS_ENV_FILE as an absolute owner-private regular-file path before launch.
+# Engraphis deliberately ignores arbitrary working-directory `.env` files.
 
 # ── Server ──────────────────────────────────────────────────────────────────
 ENGRAPHIS_HOST=127.0.0.1
@@ -204,17 +205,17 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 #   engraphis connect --token engr_ct_...        # the command your account portal shows
 #   printf %s "$TOKEN" | engraphis connect --token -   # keep the token out of shell history
 #
-# That is the supported way to connect a client. It redeems the one-time connect token, saves
-# the rotating refresh credential with 0600 permissions, and keeps it rotated afterwards, so
-# none of the variables below are needed on an interactive machine. Set
-# ENGRAPHIS_CLOUD_COMPUTE_URL (or pass --compute-url) only if your account portal shows a
-# compute endpoint different from the default. See docs/AGENT_CONNECT.md.
+# That is the supported way to connect a client. It redeems the one-time connect token,
+# saves the rotating refresh credential with 0600 permissions, and keeps it rotated.
+# The saved control and compute endpoints are immutable members of that credential family:
+# later environment changes cannot redirect its refresh or workspace upload. Reconnect
+# explicitly to change either endpoint. See docs/AGENT_CONNECT.md.
 #
-# For non-interactive deployments a refresh credential may be injected as a bootstrap secret.
-# It rotates on use; the owner-only saved replacement takes precedence afterward, even while
-# the environment variable remains set. Never commit it. Bind environment-only bootstrap
-# credentials to the subject assigned at onboarding (device or member). A short-lived access
-# token is supported for jobs.
+# For non-interactive deployments a refresh credential may be injected as a bootstrap
+# secret. It rotates on use; the owner-only saved replacement and its bound endpoints take
+# precedence afterward, even while the environment variables remain set. Never commit it.
+# Bind environment-only bootstrap credentials to the subject assigned at onboarding
+# (device or member). A short-lived access token is supported for jobs.
 # ENGRAPHIS_CLOUD_REFRESH_CREDENTIAL=
 # ENGRAPHIS_CLOUD_TOKEN_SUBJECT=member
 # ENGRAPHIS_CLOUD_ACCESS_TOKEN=
@@ -327,6 +328,10 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # ENGRAPHIS_RELAY_URL=https://relay.example.com
 # ENGRAPHIS_SYNC_TOKEN=
 # ENGRAPHIS_SYNC_READ_ONLY=0
+# Origin binding for standalone sync tokens. Must match the relay origin that issued
+# the token; prevents cross-origin token reuse. Required when using ENGRAPHIS_SYNC_TOKEN
+# without a full session credential.
+# ENGRAPHIS_SYNC_TOKEN_ORIGIN=https://relay.example.com
 # End-to-end encryption key for Cloud Sync bundles (relay transport). A single
 # immutable 32-byte URL-safe base64 value (43 chars, or 44 with one '=' pad) that
 # every authorized device shares; changing it makes previously stored ciphertext
@@ -338,7 +343,8 @@ ENGRAPHIS_LLM_MODEL=gpt-4o-mini
 # ENGRAPHIS_PRO_UPGRADE_URL=
 # ENGRAPHIS_TEAM_UPGRADE_URL=
 
-# Update check cache duration (seconds). Default: 86400 (1 day).
+# Update check cache duration (seconds), bounded to 1..31622400. Invalid values use the
+# 86400-second (1 day) default. The cache path is fixed under owner-private Engraphis state.
 # ENGRAPHIS_UPDATE_CACHE=86400
 
 # Legacy inspector port (retired 2026-07-10; redirects to dashboard).

.gitattributes

@@ -1,6 +1,12 @@
+* whitespace=cr-at-eol
 *.pyd binary
 *.so binary
 *.dll binary
+.github/workflows/*.yml text eol=lf
+.github/workflows/*.yaml text eol=lf
+*.sh text eol=lf
+deploy/*.lock text eol=lf
+deploy/*.licenses.json text eol=lf
 .claude-plugin/*.json text eol=lf
 .claude-plugin/skill-assets.sha256 text eol=lf
 skills/engraphis-memory/*.md text eol=lf

.github/codeql/codeql-config.yml

@@ -6,10 +6,7 @@
 # checks, or any cryptographic purpose. The code sets usedforsecurity=False.
 #
 # Changing to SHA-256 would invalidate all existing local vectors and break
-# the documented compatibility invariant in regression tests.
+# the documented compatibility invariant in regression tests. The release SARIF
+# gate waives only the two exact call sites; the CodeQL query remains enabled.
 
 name: "Engraphis CodeQL config"
-
-query-filters:
-  - exclude:
-      id: py/weak-sensitive-data-hashing

.github/dependabot.yml

@@ -7,6 +7,20 @@ updates:
     open-pull-requests-limit: 5
     labels:
       - "dependencies"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:

.github/release-constraints.txt

@@ -6,3 +6,4 @@ wheel==0.47.0
 build==1.5.0
 twine==6.2.0
 pip-audit==2.10.1
+cyclonedx-bom==7.3.0

.github/workflows/ci.yml

@@ -241,8 +241,10 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[test]" "uvicorn[standard]>=0.29"
-          npm ci
+          npm ci --ignore-scripts --omit=optional
           npx playwright install --with-deps chromium
+      - name: Audit the root browser dependency lock
+        run: npm audit --audit-level=high
       - name: Playwright desktop/mobile, keyboard, CSP, console, and axe checks
         run: npx playwright test