Add typed long-term context graph

[hungrytech]

Summary

• parse typed OKF relations with provenance and temporal context
• expose additive typed edges through filesystem and Neo4j projections
• add document-centered context graph navigation in the web UI
• document the curator-driven Source → Concept/Comparison → Project/decision promotion flow in four languages
• explicitly distinguish implemented behavior from future automatic promotion

Safety and compatibility

• Markdown/OKF remains canonical; Neo4j remains rebuildable
• existing Markdown links remain links-to edges
• relation targets are normalized and cannot escape the wiki bundle
• unrelated local files and web/vite.config.ts are excluded

Verification

• uv run --project server pytest server/tests -q — 32 passed
• npm --prefix web test -- --run — 9 passed
• npm --prefix web run build — passed
• git diff --check — passed

Current release caveat

This repository currently has no GitHub Actions workflow, so there is no remote CI evidence yet. The PR remains a release candidate until independent review and exact-SHA runtime verification complete.

[hungrytech]

Exact candidate verification: e20157148aa47d44e316169456a7fc39f8d8e051

Verified from a detached clean worktree:

• server: 29 tracked tests passed
• web: 9 tests passed
• production build passed
• npm ci succeeded
• npm audit --audit-level=high: 0 vulnerabilities
• real corpus runtime: 374 nodes, 583 edges, 6 typed relations
• browser: context mode, SVG graph, relation labels, and console error-free smoke verified
• exact SHA and clean tree re-check passed

Notes:

• Starlette emitted one upstream TestClient deprecation warning.
• This repository has no GitHub Actions workflow, so no remote CI check is available. Independent exact-SHA review remains required before merge/release.

[hungrytech]

Final candidate: 86fb87270cb392355ac0e07b72e8618472c1f5a4

Prior independent-review blockers addressed:

• malformed relation ingest now returns HTTP 422 and creates no document
• Concept positional constructor compatibility restored by appending relations after existing optional fields
• graph mode exposes aria-pressed; interactive SVG is a labelled group with named keyboard-operable nodes
• pinned, read-only GitHub Actions CI added

Evidence at this exact SHA:

• GitHub Actions Server tests: pass
• GitHub Actions Web tests and build: pass
• local full suite: 34 tests passed (includes 3 pre-existing untracked duplicate tests); committed exact candidate CI runs tracked tests
• web: 9 tests passed; production build passed
• npm audit: 0 vulnerabilities
• runtime malformed relation: 422 with no file creation
• real corpus: 374 nodes, 583 edges, 6 typed relations
• browser: aria-pressed state transition, graph role=group, named node buttons, and Enter-key detail navigation verified

Final independent exact-SHA re-review is in progress. Merge/tag/release remains blocked until APPROVE.

[hungrytech]

Final release candidate: ab23588aaf45dba284b58d680444dbdbda599345

Additional clean-clone release gate addressed:

• preserve existing split .env / .env.api Compose contract
• add tracked .env.example / .env.api.example with matched local-only credentials
• document copy-if-missing setup in EN/KO/JA/ZH without overwriting existing local files
• CI copies examples, validates credential agreement, and runs docker compose config

Exact-head GitHub Actions run: https://github.com/hungrytech/knowledge-wiki/actions/runs/30618766319

• Server tests: pass
• Web tests/build/audit: pass
• Compose config: pass
• Release ready aggregate: pass
• annotations: 0

The GitHub commit archive was downloaded independently; required files were present and its clean-source Quickstart preprocessing plus Compose config passed. Release remains fail-closed pending independent approval of this exact SHA.

[hungrytech]

Final candidate superseded again after security review: 8ba383f0d8484e08e7422ad30a82e1869f597166.

Fail-closed fixes since 9b36c20:

• resolve every URL hostname and reject any non-global or multicast answer
• pin the actual connection to the validated IP while retaining the original Host and TLS SNI (closes DNS-rebinding TOCTOU)
• disable automatic redirects; validate, resolve, and pin every hop; cap redirects at five
• reject credentials, malformed ports, unsupported schemes, private/link-local/loopback/metadata targets
• stream response bodies with Accept-Encoding: identity and a 5 MiB decoded-body cap
• map failures to 422 before any Markdown write

Regression coverage includes DNS-to-loopback, multicast literals, IP pinning/Host/encoding, private redirect rejection before a second request, and response-size rejection. Real pinned HTTPS smoke passed.

Exact-head CI run 30621057464: server, web test/build/audit, Compose, and fail-closed aggregate all passed; annotations: 0. Prior-SHA reviews remain stale and are not release approvals.

[hungrytech]

Current final candidate: 26719a9c399f70919f3f3df912b6868914423981.

Additional fail-closed hardening after stale review findings:

• NAT64 / IPv4-embedded IPv6: only validated public IPv4 answers are eligible for the pinned connection; IPv6-only/NAT64 targets are rejected
• slow-drip: 5s network inactivity timeout plus a 20s wall-clock ingest deadline checked after DNS, after response headers, and per body chunk
• EN/KO/JA/ZH README security notes now state the exact public-IPv4, IPv6/NAT64, compression, 5 MiB, and 20s limits

Exact evidence:

• Actions run https://github.com/hungrytech/knowledge-wiki/actions/runs/30622130515: all four gates pass, annotations 0
• clean GitHub source archive: server 39 passed, web 9 passed, audit 0, production build pass, Compose config pass
• exact archive Docker images built; API /api/health returned ok; web returned HTTP 200
• exact runtime rejects loopback, multicast, and NAT64 literals with 422

Publishing remains blocked pending an independent SHA-bound approval of 26719a9.

[hungrytech]

Current exact candidate: a33641718cab3b614c6bf88c3675cb74433ec714.

Follow-up release-boundary fixes since 26719a9:

• DNS resolution is bounded by the same monotonic ingest deadline using four guarded resolver slots; no unbounded queued resolver work
• each HTTP phase receives min(5s, remaining absolute budget)
• explicit port 0 is rejected before DNS resolution
• ambient HTTP(S) proxy discovery is disabled so the validated IP remains the actual connection target

Exact evidence:

• Actions run https://github.com/hungrytech/knowledge-wiki/actions/runs/30623143860: all four gates pass; annotations 0
• local full suites: server 46 passed; web 9 passed; audit 0; production build and Compose config passed
• real HTTPS source fetch passed
• exact runtime health passed and port 0 / loopback / multicast / NAT64 inputs returned 422

The prior SHA review results are stale. Publishing remains fail-closed pending an independent approval of exact a336417 and completion of the clean-archive gate.

[hungrytech]

GitHub-authenticated clean archive gate completed for exact a33641718cab3b614c6bf88c3675cb74433ec714 without reusing the working tree.

• archive SHA-256: 098dae30d0fa6436fae5bbcc65bca32beb4b95209053fdabd2298629b849a35a
• Compose clean-clone config: passed with copied example env files
• server: 43 passed
• web: 9 passed
• npm audit: 0 vulnerabilities
• production build: passed
• archive Docker api and web images: built
• API container /api/health: ok
• web container: HTTP 200

Release remains blocked only on an independent exact-SHA APPROVE.

[hungrytech]

Current exact candidate: 5f7c755f5689436c41c45b77fd478b518bc70a87.

The a336417 independent review BLOCK is resolved by removing the process-global ThreadPoolExecutor and semaphore entirely. DNS A/AAAA queries now use dnspython 2.8.0 with each query receiving only the remaining monotonic ingest lifetime; no non-cancellable worker threads, retained slots, executor shutdown, or unbounded work queue remain. Mixed public/private A/AAAA sets fail closed. The dependency is locked and installed in the API Docker image.

Exact evidence:

• CI run https://github.com/hungrytech/knowledge-wiki/actions/runs/30628460003: four gates pass, annotations 0
• GitHub-authenticated archive SHA-256: 4048fb137ca874ba9b85b9f033c91a6084b8ae83442e27a45fcb1bd9935b7c67
• clean archive server: 45 passed
• clean archive web: 9 passed; audit 0; production build passed
• clean Compose config passed
• clean archive Docker API/Web images built after reclaiming inactive build cache
• API image real https://example.com/ DNS/TLS fetch passed; API health ok; web HTTP 200
• exact local runtime health passed; port 0, loopback, multicast, and NAT64 literal inputs returned 422

Publishing remains fail-closed pending an independent approval bound to exact 5f7c755.

[hungrytech]

Final exact candidate is now 8989656a798cc870da01faabd5692b561db9d78d.

A clean Docker rebuild exposed dependency drift in the previous Dockerfile (sentence-transformers 5.6.1 despite the project <4 contract). This was corrected before publication:

• Docker now exports exact production dependencies from committed uv.lock using pinned uv==0.12.0.
• CPU-only torch==2.13.0+cpu remains pinned to the PyTorch CPU index.
• uv export --prune torch prevents lockfile GPU/CUDA dependency entries from entering the CPU image.
• Verified image versions: dnspython 2.8.0, FastAPI 0.139.0, sentence-transformers 3.4.1, torch 2.13.0+cpu, transformers 4.57.6; CUDA package count 0.

Final exact evidence:

• CI https://github.com/hungrytech/knowledge-wiki/actions/runs/30629152319: all four jobs pass, annotations 0
• authenticated tarball SHA-256: 6db489e85d7f159a2add21742460f0ecb4e78f4cebf91eeb404dceabbda2862f
• clean server 45 passed; clean web 9 passed; npm audit 0; build and Compose config passed
• exact clean Docker API/Web builds passed
• real HTTPS fetch passed; API health ok; web HTTP 200
• PR is mergeable/CLEAN; main remains a47337c; no v0.1.0 tag

Publication remains fail-closed pending independent approval bound to exact 8989656.

[hungrytech]

Final exact candidate after resolving the slow-response-header lifecycle BLOCK: 8e4eddce5af96c739d2c43e4a300344b2fa6f2c7.

The URL fetch path now preserves the synchronous API while executing HTTP I/O through httpx.AsyncClient under one asyncio.timeout that covers response headers, redirects, and body streaming. Cancellation unwinds and closes the response/client resources. The existing monotonic deadline still bounds synchronous dnspython resolution.

New regression evidence includes both a cancellable in-memory slow-header transport and a real TCP server that drip-feeds an incomplete response header, verifies return within the total budget, and observes peer socket closure. The real-socket probe was reproduced on Linux and is part of CI.

Exact evidence:

• CI run: https://github.com/hungrytech/knowledge-wiki/actions/runs/30630734530 — all 4 gates passed; annotations 0
• Clean authenticated source: server 47 passed; web 9 passed; npm audit 0; production build and Compose passed
• Source tarball SHA-256: 4cf6bcfbe902eb0db7c2c452e9371871471c5862667afd692b4afdaaed1b7d97
• Clean exact-source Docker API/web builds passed
• Exact API image: public HTTPS fetch, API health, and /api/ingest-url runtime passed
• Exact web image returned HTTP 200

main and v0.1.0 remain unchanged pending a new independent APPROVE bound to exact SHA 8e4eddc.

[hungrytech]

Published after fresh independent APPROVE bound only to exact SHA 8e4eddce5af96c739d2c43e4a300344b2fa6f2c7; no blocker/high/medium issue was found.

Promotion and publication evidence:

• main was fast-forwarded directly from a47337c to exact approved object 8e4eddc (no merge/rebase/squash rewrite)
• PR merge commit: exact 8e4eddc
• Published source release: https://github.com/hungrytech/knowledge-wiki/releases/tag/v0.1.0
• v0.1.0 tag target: exact 8e4eddc
• Post-merge push CI: https://github.com/hungrytech/knowledge-wiki/actions/runs/30631690391 — all 4 jobs passed, 0 annotations
• Public tag tarball SHA-256: 1508002e43ac5458a03231d9aab80edf6c9ca694e7d1d776c1584a49616f5d82
• Extracted public archive tree: 55aa7f713989b4c305f7522cdabcff98ace87c99, matching exact candidate tree
• Unauthenticated release API verification: published, non-draft, non-prerelease, exact SHA/checksum present in notes

CI retained no build artifacts; this is explicitly a source release. The public GitHub-generated source archive was independently downloaded and tree-verified after publication.