v0.7.0 — doc↔doc RELATES edges

Joins the doc graph to the code graph (dev-platform XSPEC-331 R2).

Added

• Spec→Spec references (front-matter related/depends_on or [[XSPEC-NNN]]) now produce a RELATES(Spec→Spec) edge, on the same Spec nodes IMPLEMENTS points at — so Function ← Module → IMPLEMENTS → Spec → RELATES → Spec is one connected graph. related traverses these; index --docs reports a relates count.
• depends_on relationship field + XSPEC- prefix now captured in relationship front-matter.

Changed

• Schema adds a RELATES(FROM Spec TO Spec) table. ⚠️ Existing .engram DBs must be rebuilt.

v0.6.0 — doc↔code query tools (CLI + MCP)

Exposes XSPEC-331 R1's doc↔code linkage as usable queries.

Added

• CLI: implementers <spec-id> (spec→code, with each file's functions) and implemented-by <module-path> (code→spec).
• MCP tools: implementers, implemented_specs, and related (previously CLI-only) — an MCP client can now answer 'which code implements this spec?', 'which spec governs this file?', and 'what's connected to X?' in-conversation. The MCP server advertises 8 tools (was 5).

Verified via CLI over a real graph + unit and MCP tests.

v0.5.0 — code↔spec IMPLEMENTS linkage

Bidirectional code↔spec linkage from // implements comments (dev-platform XSPEC-331 R1). IMPLEMENTS is now Module→Spec; artifact-id regex now matches the XSPEC- prefix. Existing .engram DBs must be rebuilt. See CHANGELOG for details.

v0.4.1 — resolve CALLS for functions passed by reference

Fixed

• `callers()`/CALLS resolution missed a function passed by reference as a direct call argument (e.g. Fastify's `app.register(pluginFn, opts)`) — only literal `fn()` call-expression callees were captured. Found by comparing egr against an external tool (colbymchenry/codegraph) on a real codebase: `callers` returned nothing for a route-registration function invoked this way, across dozens of same-shaped files. The extractor now also records a CALLS edge when a known function's bare identifier appears as a direct (non-nested) argument in a call's argument list; an identifier buried inside an object/array literal argument (e.g. `foo({ handler: bar })`) is deliberately still not captured — materially weaker signal, out of scope for this fix. No schema change (reuses the existing `CALLS` edge; no new property, no migration).

Full changelog: https://github.com/AsiaOstrich/EngramGraph/blob/main/CHANGELOG.md#041--2026-07-12

v0.4.0

Added

• egr god-nodes [--limit N] — importance ranking via ryugraph's native
  PageRank extension (DEC-027, structural-memory L3; concept borrowed from
  graphify's god_nodes, but
  computed directly against ryugraph's built-in algo extension instead of
  a ported implementation).
• egr communities — clustering via ryugraph's native Louvain extension
  (DEC-027, L3). Scoped to Function/CALLS only — ryugraph's Louvain
  rejects heterogeneous projected graphs at runtime ("only supports
  operations on one node table"); PageRank has no such restriction.
• egr related <node-id> [--depth N] [--limit N] — seeded-neighborhood
  importance ranking (DEC-028, structural-memory L4a): a depth-bounded BFS
  around the seed id, projected to a filtered subgraph, ranked by PageRank.
  Approximates HippoRAG-style personalized PageRank ("what matters near
  this node") without a hand-written iterative algorithm, and correctly
  crosses node types (e.g. Function → Spec via IMPLEMENTS). Does not
  cover turning a free-text query into seed ids (HippoRAG's OpenIE +
  fact-reranking layer) — out of scope without a semantic/embedding layer.

Fixed

• Native-addon crash on teardown: opening and closing more than ~6
  cumulative GraphConnections in a single process (each loading the
  ryugraph algo extension) could segfault on worker exit, even though
  every individual test assertion passed. The test suite now shares one
  connection per file/describe block instead of one per test.
• Local install docs: npm install engramgraph (non-global) does not put
  egr on PATH. README now recommends npm install -g engramgraph for
  CLI use, with a separate note for library (import ... from "engramgraph") use cases.

Known Limitations

• Linux ARM64: ryugraph@25.9.1 ships an incorrect native binary for
  this platform (byte-identical to the x86-64 build) — tracked upstream at
  predictable-labs/ryugraph#48.
  Affects Docker Desktop on Apple Silicon Macs (defaults to linux/arm64),
  AWS Graviton, and other ARM64 Linux hosts.
• Linux x64 with glibc < 2.38 (e.g. Ubuntu 22.04 LTS, Debian 12): the
  ryugraph@25.9.1 native binary requires a newer glibc than these
  still-common LTS distros ship.
• See the README's Platform support matrix
  for the full compatibility table, verification method, and workarounds.
  Both limitations pre-date this release (present since ryugraph@25.9.1
  was introduced in 0.3.0) — this release does not introduce or worsen
  either one.

v0.3.0 — kuzu → ryugraph migration (npm audit: 5 high → 0)

Why this release

In October 2025, KuzuDB — EngramGraph's embedded graph database — was archived by its creator. The kuzu npm package was deprecated, carrying 5 high-severity vulnerabilities in its transitive dependencies with no fix coming.

Security

• Replaced abandoned kuzu@0.11.3 with ryugraph@25.9.1 (actively maintained Kuzu fork by Predictable Labs, MIT). Eliminates the high-severity vulnerabilities introduced via kuzu's deprecated transitive deps (npmlog, gauge, are-we-there-yet).
• Added npm overrides forcing cmake-js@^8.0.0, lifting the transitive tar to a patched version. npm audit is now clean — 0 vulnerabilities.

⚠️ npm overrides do not propagate to downstream consumers. If your project depends on engramgraph, add "overrides": { "cmake-js": "^8.0.0" } to your own package.json until ryugraph bumps cmake-js upstream.

Breaking change

• KuzuValue type renamed to RyuValue in all public APIs (GraphConnection.query(), EmbeddedClient.query()). Update imports:

import type { RyuValue } from "ryugraph";

Compatibility

• ryugraph's API is signature-identical to kuzu (prepare/execute/query/getAll unchanged).
• Existing .engram/graph.db databases keep working (same storage format lineage).
• 69/69 tests pass, tsc --noEmit clean.

Upgrade

npm install engramgraph@0.3.0

v0.2.0

Standalone general-purpose positioning: no consuming-project references in docs or source. BREAKING: export XspecDecKnowledgeSource → SpecDecisionKnowledgeSource; reference adapter recognizes SPEC-/DEC-/ADR- (dropped XSPEC- alias). See CHANGELOG.md.

v0.1.1

First release via OIDC Trusted Publishing. Drops ./ from bin paths. See CHANGELOG.md.

v0.1.0

First public release of @asiaostrich/codesage — a code + knowledge graph memory engine (SAGE + CodeGraph) on embedded Kuzu, usable as a library, REST service, MCP server, or CLI. See CHANGELOG.md.

Includes per-branch / per-project graph isolation (XSPEC-245) and the high-level EmbeddedClient facade (XSPEC-244 P2a).