- fix(redos) #10: replace capturing group with non-capturing group in
naming_conventions.py to eliminate exponential backtracking (py/redos)
- fix(html-filter) #4: update script/iframe end-tag regex to match
tags with trailing attributes e.g. </script foo="bar"> (py/bad-tag-filter)
- fix(regex-range) #9: replace overly broad [$-_] character range with
explicit safe-char list in email_ingestor.py URL pattern (py/overly-large-range)
- fix(info-exposure) #5: replace str(exc) with a generic error message
and log the full stack trace server-side in export_import.py (py/stack-trace-exposure)
Closes#4, Closes#5, Closes#9, Closes#10
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GITHUB_TOKEN cannot change Default Setup (requires admin rights — HTTP 403).
Removed the disable-default-setup job entirely.
New approach:
- analyze job: runs CodeQL with upload:false then uploads SARIF via
upload-sarif with continue-on-error:true so the workflow does not fail
if Default Setup is still active
- dismiss-fixed-alerts job: runs on push to main, fetches all open alerts
matching the 3 fixed rule IDs and dismisses them via PATCH API which
only requires security-events:write (no admin needed)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The previous fix used || true in a single-step which masked API failures
and had no propagation delay — Default Setup remained active when the
SARIF upload ran, causing the same conflict error.
Changes:
- New job `disable-default-setup` runs first: calls the API, waits 30s,
then polls to confirm state=not-configured before exiting
- `analyze` job depends on `disable-default-setup` via `needs:` so CodeQL
only runs after the state change is confirmed propagated
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Advanced Setup and Default Setup cannot run simultaneously — SARIF upload
fails with "cannot be processed when the default setup is enabled".
Added a pre-analysis step that calls the GitHub code-scanning API to switch
Default Setup to not-configured before CodeQL runs, eliminating the conflict.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds explicit CodeQL analysis workflow triggered on push/PR to main and
weekly schedule. Without this, GitHub Default Setup only runs on a
schedule — alerts do not re-scan after a PR merge, leaving fixed
vulnerabilities still shown as open.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- test_vocabulary.py: remove sys.modules['spacy'] = MagicMock() — caused
ValueError in pytest collection when transformers called
importlib.util.find_spec('spacy') on a MagicMock without __spec__;
add setup_function() reset_mock() to prevent cross-test state pollution;
expand from 3 to 16 tests covering narrower edges, topConceptOf,
hasTopConcept, flat scheme, empty scheme, missing param, cycle safety,
.rdf/.owl format path, invalid file 422, and metadata envelope fallback
- vocabulary.py: /import returned HTTP 200 with {"status":"error"} on parse
failure — now raises HTTPException(422) so clients get a proper error code;
replace bare except with ValueError-specific catch, move add_nodes/add_edges
outside the try block
- vocabulary.py: get_hierarchy tree assembly had no cycle detection — cyclic
broader/narrower edges in real-world SKOS data would cause infinite recursion
during Pydantic serialization; replaced inline loop with recursive
_attach_children() that carries a visited set
- semantica/explorer/utils/: branch was based on main and missing rdf_parser.py
and __init__.py (introduced in #425); copied from ebd2be3 so vocabulary.py
import resolves correctly
- tests/explorer/test_rdf_parser.py: carried forward from #425 (32 tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- server.py: split vocabulary router into its own try/except so a missing
vocabulary module (pending #421) cannot prevent the 7 existing routers
from mounting
- rdf_parser.py: rename `format` param to `rdf_format` to avoid shadowing
the Python builtin; add exception chaining (raise...from e); document
the silent edge-drop behaviour for cross-vocabulary URIs
- Add semantica/explorer/utils/__init__.py (package was not importable)
- Add tests/explorer/test_rdf_parser.py: 32 tests covering node/edge
extraction, label priority, altLabel dedup, all 6 SKOS edge types,
orphan-edge filtering, empty graph, error cases, and RDF/XML format
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extends the existing ontology and triplet-store stack with first-class
SKOS support without adding any new top-level packages.
### semantica/ontology/namespace_manager.py
- `get_skos_uri(local_name)` — build full skos:core# URI from local name
- `build_concept_scheme_uri(name)` — slug a human name into a stable
ConceptScheme URI anchored at the configured base URI
### semantica/triplet_store/triplet_store.py
- `add_skos_concept(concept_uri, scheme_uri, pref_label, ...)` — asserts
ConceptScheme + Concept triples, prefLabel, altLabel, broader, narrower,
related, definition, notation via existing `add_triplets()` API
- `get_skos_concepts(scheme_uri=None)` — SPARQL SELECT via `execute_query()`,
collapses multi-valued bindings into concept dicts
### semantica/ontology/engine.py
- `list_vocabularies()` — list all skos:ConceptScheme instances
- `list_concepts(scheme_uri)` — list concepts in a scheme with alt labels
- `search_concepts(query, scheme_uri=None)` — case-insensitive substring
search over prefLabel + altLabel; sanitises user input against SPARQL injection
### tests
- `TestSKOSOntologyEngine` (14 tests) in test_ontology_comprehensive.py
- `TestSKOSTripletStore` (6 tests) in test_triplet_store.py
- All 1162 existing + new tests pass, 0 failures
### docs/reference/ontology.md
- New "SKOS Vocabulary Management" section: data-model table, import
examples (add_skos_concept + rdflib bulk), list/search API, NamespaceManager helpers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Rewrote index.md to match README (tagline, badges, Problem/Solution text)
- Improved getting-started, concepts, quickstart, installation, faq, use-cases, contributing, glossary, learning-more, examples, modules, architecture, cookbook, deep-dive pages: tighter prose, fixed headings/bullets, removed inconsistencies and duplicate sections
- Removed overuse of emojis from headings in integration pages (docling, snowflake)
- Fixed change_management reference page: closed unclosed JSON code block that broke the right TOC, demoted noisy sub-headings to bold text
- CSS layout: widened content area (max-width 1440px grid, left sidebar 11rem, right TOC narrowed to 11rem for broader content), tightened TOC spacing and font size, fixed word-wrap/overflow on TOC links
- Added mkdocs_local.yml for local serving without mkdocs-jupyter plugin
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add TemporalGraphRetriever to context_retriever.py (no new file per project convention)
- Drop-in wrapper for ContextRetriever; filters related_entities/related_relationships
via reconstruct_at_time(); at_time=None is a true passthrough
- Returns new RetrievedContext objects (no in-place mutation)
- Graceful ImportError if temporal modules unavailable
- Add at_time + header_template to ContextRetriever._generate_reasoned_response()
and query_with_reasoning()
- Temporal header prepended to LLM context block only when at_time is set
- Naive datetimes normalised to UTC before formatting
- Header built with str.replace (not .format) to prevent format-string injection
- Add TemporalQueryRewriter + TemporalQueryResult to semantica/kg/
- Regex-only (default) and LLM-assisted extraction modes
- Resolves temporal phrases via TemporalNormalizer (deterministic, zero LLM)
- Word-boundary guards on intent keywords; year fallback for noun-phrase dates
- Never calls reconstruct_at_time — extraction only
- Export TemporalGraphRetriever from semantica.context
- Export TemporalQueryRewriter, TemporalQueryResult from semantica.kg
- Add 99 tests across two new test files
- tests/context/test_temporal_retriever.py (56 tests)
- tests/kg/test_temporal_query_rewriter.py (43 tests)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add `extract_temporal_bounds: bool = False` to `extract_relations_llm()`.
When True the LLM prompt is extended with a calibrated confidence scale
and four few-shot examples; each returned Relation gains valid_from,
valid_until, temporal_confidence, and temporal_source_text in metadata.
Low confidence (<0.5) with non-null dates logs a WARNING. Default False
preserves 100% backward compatibility.
- Add `RelationWithTemporalOut` / `RelationsWithTemporalResponse` Pydantic
schemas so the four temporal fields are captured from structured LLM
output (separate from RelationOut which uses extra="ignore").
- New `semantica/kg/temporal_normalizer.py` — `TemporalNormalizer` class
(zero LLM calls, pure regex + dateutil arithmetic):
* normalize(value) → (start, end) UTC datetimes or None
* Resolution order: ISO 8601 → partial dates (year/month/Q) →
ambiguity detection → domain phrase map → relative phrases
* normalize_phrase(phrase) → metadata dict or None
* Default phrase map covers 13 domains: General, Policy, Healthcare,
Drug Discovery, Cybersecurity, Supply Chain, Finance, Energy
* TemporalAmbiguityWarning for DD/MM/YYYY-style ambiguous inputs
* Custom phrase_map at construction (merged over defaults)
- Add `TemporalAmbiguityWarning(UserWarning)` to exceptions.py.
- Export `TemporalNormalizer` from `semantica/kg/__init__.py`.
- Propagate `extract_temporal_bounds` through `_extract_relations_chunked`
and add flag to cache key to prevent cross-mode cache pollution.
- 53 new tests in tests/semantic_extract/test_temporal_extraction.py;
zero real LLM calls, suite runs in ~3.5s. 873 existing tests unaffected.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Closes#408
Previously `_init_client` assigned the raw `ollama` module to
`self.client`, so the `base_url` parameter was silently ignored and
every request hit the default localhost:11434. Now an `ollama.Client`
instance is created with `host=self.base_url`, so remote Ollama servers
are reachable.
Three regression tests added to prevent recurrence:
- default base_url is forwarded as host
- custom base_url (e.g. http://192.168.1.3:11434) is forwarded as host
- self.client is never the raw module
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix max_depth error message: "1 and 20" -> "1 and 100" to match actual check
- Fix Cypher query at_time param to RFC3339 UTC (append Z) for unambiguous DB comparisons
- Fix _normalize_temporal_input to raise ValueError on unparseable strings instead of returning raw input
- Fix datetime.now() -> datetime.utcnow() in recorded_at stamps and checkpoint timestamps (matches codebase convention, avoids wrong local time on Windows)
- Wrap TemporalVersionManager() construction in flush_checkpoint with clear RuntimeError
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
