semantica-agi/semantica

Bug Description semantica temporal history renders its timestamps through two different code paths depending on the output mode. --format json emits ISO 8601 (2025-01-01T00:00:00Z), but the default output (--format table) still falls through _pprint, whose json.dumps(..., default=str) produces the space-separated str(datetime) form. The same command therefore reports two different timestamp formats, and its default output disagrees with semantica temporal distance, which is ISO in both modes. This is the one residual left after #1987, which fixed the --format json path only. Steps to Reproduce Have a memory-backend graph with any temporal fact (e.g. a node with valid_from / recorded_at). Run semantica temporal history <entity_id> --format json and semantica temporal history <entity_id> (default is --format table). Compare the timestamp fields. Expected Behavior Both output modes should render the same timestamp format, and it should be ISO 8601, consistent with temporal distance. Act

Problem After #1870, tests/test_embedding_providers.py::TestEmbeddingProviders::test_embedding_generator_config runs on the Linux CI runner. It was previously deselected everywhere. It loads BAAI/bge-small-en-v1.5 through fastembed at test time. The model isn't cached or hash-pinned, and the rest of the job installs dependencies with --require-hashes. If the hub is down or rate-limited, the backend falls back and the test fails with 128 != 384, which turns the build red for an unrelated reason. Suggested fix Either: cache the fastembed / Hugging Face model directory with actions/cache in the full-suite step, or mark the test integration (or skip it when offline) so a hub outage can't fail the build. Context Raised during review of #1870. Not a blocker for that PR.

Summary Follow-ups found during the final review of #1919 (fix for #1257). None of these blocked that PR. They are grouped here so they can be fixed in one small PR. 1. Legacy server has the same WebSocket 403 (bug) semantica/server.py:97-111 only allows the 5173 Vite origins, but the server listens on port 8000. A browser opened on :8000 gets the same WebSocket 403 that #1257 describes for the Explorer. Fix: apply the same default as semantica/explorer/app.py: allow localhost:<port> and 127.0.0.1:<port> unless ALLOWED_ORIGINS or EXPLORER_CORS_ORIGINS is set explicitly. Add a regression test. 2. Test depends on the developer's shell (tests) The test at tests/explorer/test_explorer_auth.py:230 uses the shared client fixture, which builds the app from the process environment. It fails if the shell exports ALLOWED_ORIGINS. Fix: unset ALLOWED_ORIGINS and EXPLORER_CORS_ORIGINS in the fixture with monkeypatch.delenv, or build the app inside the test. 3. Lint regressions in tests/explorer/tes

Follow-ups from the independent review of #1940 (APPROVE WITH NITS, no blockers) and the Verify Action Pins cleanup (#1899 and the setup-node/upload-artifact pin bump). None of these block anything today. A. Report Scheduled Failure step (.github/workflows/security-scan.yml) Label creation swallows all errors. The createLabel catch (~line 610) ignores every failure, not just 422 (label already exists). Check e.status === 422, and log or rethrow anything else. The label doesn't exist yet, so the first real failure goes through this path. Move reporting into a separate job (needs: security-scan, if: failure() && github.event_name == 'schedule', permissions issues: write + actions: read, reading the uploaded report artifact). Today issues: write (line ~89) also applies to pull_request runs of the scan job, which install PR-controlled dependencies. Forks get a read-only token, so the exposure is small, but a separate job removes it. Auto-close the tracking issue on recovery. Today an o

Bug Description ArrowExporter.export() loses relationship endpoints when it is called directly with records that name them the way the server backends do (start_node_id/end_node_id, or start_id/end_id). The file is written without an error, but neither endpoint is in it. #1719 moved the endpoint names into semantica/export/endpoint_names.py and taught the export router and ParquetExporter to use them. Its notes left the direct Arrow path for a separate change: ArrowExporter._write_arrow still has its own check that only knows source*/target* (semantica/export/arrow_exporter.py:674-684). Steps to Reproduce from pathlib import Path from tempfile import TemporaryDirectory import pyarrow.ipc as ipc import pyarrow.parquet as pq from semantica.export import ArrowExporter, ParquetExporter edges = [{"id": "r1", "start_node_id": "alice", "end_node_id": "acme", "type": "WORKS_AT"}] with TemporaryDirectory() as tmp: arrow = ArrowExporter().export({"edges": edges}, Path(tmp) / "graph.arrow"