chore(release): bump version to 1.7.2

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "engraphis-memory",
       "source": "./",
       "description": "Discipline for giving agents durable, scoped, explainable memory across sessions and repos with the Engraphis MCP tools.",
-      "version": "1.7.1"
+      "version": "1.7.2"
     }
   ]
 }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "engraphis-memory",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Give agents durable, scoped, explainable memory across sessions and repos via the Engraphis MCP tools. Use when you learn something worth keeping, need prior context before acting, or ask why/how a fact changed. Covers remember/recall, why/timeline, forget/pin/correct, sessions, and code search.",
   "author": {
     "name": "The Engraphis Authors",

.claude-plugin/skill-assets.sha256

@@ -1,5 +1,5 @@
-b763e4600bf830d79ef563c805b919e5798b727b88f9eeb81f2b15480b082dc6  .claude-plugin/marketplace.json
-a8307092284d9ab4ba62f4f089d14a674c33d0f241a8430ffd89abb19e5f1ca0  .claude-plugin/plugin.json
+595a395f048219beb8dd741443b17d889e725effa91bf3f20578bbe497f5d55e  .claude-plugin/marketplace.json
+8294e6c2de066bd7dee01251cea42d301904cbf94a17cf8f884b26f0a67f7dc0  .claude-plugin/plugin.json
 4bc8979b9ffeb97190960e551dbf4ddc6f7aeeb7b86894fd2298a59ff0001efa  skills/engraphis-memory/SKILL.md
 055655db84af07561d002f0c69744313d8413c39f3e873f941f0fa0b1e76dc66  skills/engraphis-memory/references/CONVENTIONS.md
 62019760766ff472a76a0f81437898f39e3c1fe2631732b7b7733e50c1ad837f  skills/engraphis-memory/references/SCOPING.md

.github/workflows/ci.yml

@@ -288,7 +288,7 @@ jobs:
           if [ "${{ github.event_name }}" != "pull_request" ]; then
             echo "run=true" >> "$GITHUB_OUTPUT"
           elif git diff --name-only "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" \
-              | grep -qE '^(Dockerfile|docker-entrypoint\.sh|docker-compose(\.lan)?\.yml|railway\.json|deploy/|\.dockerignore|engraphis/|scripts/|pyproject\.toml|\.github/workflows/ci\.yml)'; then
+              | grep -qE '^(Dockerfile|docker-entrypoint\.sh|docker-compose(\.lan)?\.yml|railway\.json|deploy/|\.dockerignore|engraphis/|scripts/|pyproject\.toml|\.github/workflows/)'; then
             echo "run=true" >> "$GITHUB_OUTPUT"
           else
             echo "run=false" >> "$GITHUB_OUTPUT"

.github/workflows/codeql.yml

@@ -28,14 +28,14 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           config-file: ./.github/codeql/codeql-config.yml
       - name: Analyze
         id: analyze
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           output: codeql-results
       - name: Require clean CodeQL results

.github/workflows/release.yml

@@ -549,7 +549,7 @@ jobs:
           metadata.unlink()
           PY
       - name: Generate whole-image SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: engraphis:release
           format: cyclonedx-json
@@ -582,7 +582,7 @@ jobs:
           )
           PY
       - name: Scan whole production image
-        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+        uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 # v7.4.2
         with:
           image: engraphis:release
           fail-build: false
@@ -678,14 +678,14 @@ jobs:
         with:
           python-version: "3.11"
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           config-file: ./.github/codeql/codeql-config.yml
       - name: Analyze complete source tree
         id: analyze
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
           output: codeql-results
           upload: never

CHANGELOG.md

@@ -3,7 +3,30 @@
 All notable changes to Engraphis are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/); versions use SemVer.
 
-## [Unreleased]
+## [1.7.2] - 2026-09-05
+
+### Added
+
+- Added `idx_vector_index_repairs_queue` composite index on `(identity, generation, memory_id)`
+  in `engraphis/core/schema.py` to prevent table scans during external vector repair queue dequeue.
+- Added explicit operator opt-out verification with `403 Forbidden` (`processing_operator_disabled`)
+  for authenticated direct POST requests to `/managed-processing` in `engraphis/routes/v2_api.py`.
+- Added `_only_environment_title_order_changed` in `engraphis/core/resolve.py` ensuring unkeyed
+  facts with permuted environment titles resolve to `NOOP` rather than false conflicts.
+- Added comprehensive reliability regression coverage covering storage concurrency, vector index
+  repair indexing, and managed processing policy enforcement.
+
+### Fixed
+
+- Preserved `[all]` extras fallback for legacy editable installations in `scripts/update.py`
+  when no installation profile is recorded.
+- Fixed external vector index hydration on physical index recreation and rebuilds.
+- Fixed docstring dedenting and contract normalization across Python 3.9 through 3.14.
+
+### Changed
+
+- Bumped `tree-sitter-language-pack` to 1.16.1.
+- Updated `codeql-action`, `anchore/scan-action`, and `anchore/sbom-action` GitHub Actions dependencies.
 
 ### Reliability and privacy
 

engraphis/__init__.py

@@ -2,7 +2,7 @@
 
 from importlib.metadata import PackageNotFoundError, version as _dist_version
 
-_SOURCE_VERSION = "1.7.1"
+_SOURCE_VERSION = "1.7.2"
 
 try:
     __version__ = _dist_version("engraphis")
@@ -14,7 +14,7 @@
 except PackageNotFoundError:  # source tree without an installed distribution
     # Keep in step with [project] version in pyproject.toml — tests/test_packaging.py
     # pins the two together so a release cannot ship them out of sync.
-    __version__ = "1.7.1"
+    __version__ = "1.7.2"
 
 
 def _default_memory_engine_factory(**kwargs):

engraphis/commercial_manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "engraphis-commercial/v2",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "control_plane": "https://api.engraphis.com",
   "account_portal": "https://api.engraphis.com/account",
   "billing": {

pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "engraphis"
-version = "1.7.1"
+version = "1.7.2"
 description = "Local-first AI memory engine for agents — Ebbinghaus decay, interaction-aware recall, bi-temporal facts, hybrid retrieval, and an MCP server. You bring the LLM."
 readme = "README.md"
 license = "Apache-2.0"

tests/test_release_evidence.py

@@ -1261,8 +1261,8 @@ def test_release_workflow_publishes_complete_captured_evidence():
     assert "os: [windows-latest, macos-latest]" in platform_smoke
     assert '"pip", "check"' in platform_smoke
     assert "scripts.smoke_entry_points" in platform_smoke
-    assert "anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610" in docker_job
-    assert "anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2" in docker_job
+    assert "anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26" in docker_job
+    assert "anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439" in docker_job
     assert "docker buildx build --pull --load" in docker_job
     assert '"containerimage.digest"' in docker_job
     assert "engraphis:image-digest" in docker_job