ModernRelay/omnigraph

Review signals: 10 hardcoded secret, 11 known vulnerability. 2 static matches retained as context.

Gitleaks found a possible hardcoded secret; value withheld. 3 distinct locations. 3 findings.

OSV reports a known vulnerability in this dependency version. 7 distinct locations. 11 findings.

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The built-in MCP server lets an agent connect to a running omnigraph server and call its tools.: Real input produced the expected result: edge Supports: Source -> Claim

  Source: connect an agent to the server's `/mcp`

  Input: {"tool": "schema", "arguments": {"graph": "knowledge"}}

  Expected: returns the declared Supports edge

  Command: <guest-path> --cluster /tmp/cb/company-data --bind 127.0.0.1:8080 tools/call {"tool": "schema", "arguments": {"graph": "knowledge"}}

  Observed: edge Supports: Source -> Claim\\n\",\"system_columns\":{\"id\":\"__id\",\"src\":\"__src\",\"dst\":\"__dst\"},\"catalogue_source\":\"node @Operator {\\n name: String @key\\n inputs: [I64]\\n}\\n\\nnode @Pass {\\n name: String @key\\n position: I64\\n}\\n\\nnode @Setting {\\n name: String @key\\n kind: String\\n default: String\\n scope: String\\n}\\n\\nnode @Engine {\\n version: String @key\\n current_internal_schema_version: I64\\n min_supported_internal_schema_version: I64\\n}\\n\\nnode @LogicalKind {\\n name: String @key\\n coverage: String\\n}\"}"}], "

• A --target ./graph.omni flag addresses a standalone local graph for querying.: Real input produced the expected result: Load test report

  Source: Use `--target ./graph.omni` for a standalone local graph.

  Input: stored query sources_for_claim on the local quickstart graph

  Expected: returns the two source titles

  Command: <guest-path> query sources_for_claim --query queries.gq --params '{"claim":"lower-latency"}' --format table --target ./graph.omni

  Observed: Load test report Production metrics target ./graph.omni (inline): direct graph /tmp/qs/graph.omni; requested=/tmp/qs/graph.omni; provider=Local

Examples

• Validate a cluster bundle before deploying it: command completed successfully

  Source: docs/user/clusters/index.md#bootstrap-a-cluster

  Input: /tmp/cb/company-brain

  Expected: cluster config valid

  Command: <guest-path> cluster validate --config /tmp/cb/company-brain

  Observed: cluster config valid: 5 resource(s), 4 dependency edge(s) WARN external_blob_ingress_default_deny graphs.knowledge.external_blobs: effective policy is deny: new external Blob URI references will be rejected; existing stored references remain readable

• Quickstart query returns the two sources supporting the claim: command completed successfully

  Source: docs/user/quickstart.md#4-query

  Input: sources_for_claim lower-latency

  Expected: Load test report and Production metrics

  Command: <guest-path> query sources_for_claim --query queries.gq --params '{"claim":"lower-latency"}' --format table --target ./graph.omni

  Observed: 2 rows from branch main via sources_for_claim source ------------------ Load test report Production metrics target ./graph.omni (inline): direct graph /tmp/qs/graph.omni; requested=/tmp/qs/graph.omni; provider=Local

Local or hosted: local

Install omnigraph 0.14.0 with the README installer, create and load a local graph, query it, and serve a graph over the built-in MCP endpoint (tool schema on graph knowledge).

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat /etc/os-release | head -3 && (git -C . rev-parse HEAD 2>&1 | head -1)
cd <guest-path> && ls -la; find . -maxdepth 1 -iname 'readme*' -exec cat {} \; | head -300
cd <guest-path> && cat scripts/install.sh | head -150; echo ----; cat docs/user/quickstart.md | head -200; echo ----; cat rust-toolchain.toml; which cargo rustc curl; uname -m
export NODE_USE_ENV_PROXY=1; curl -fsSL https://raw.githubusercontent.com/ModernRelay/omnigraph/main/scripts/install.sh -o /tmp/install-omnigraph.sh; echo "dl rc=$?"; bash /tmp/install-omnigraph.sh 2>&1 | tail -40; echo "rc=${PIPESTATUS[0]}"; ls -la ~/.local/bin 2>/dev/null; ~/.local/bin/omnigraph --version 2>&1
export PATH=$HOME/.local/bin:$PATH; mkdir -p /tmp/qs && cd /tmp/qs && cat > schema.pg <<'EOF'
node Source {
  slug: String @key
  title: String
}

node Claim {
  slug: String @key
  statement: String
}

edge Supports: Source -> Claim
EOF
cat > evidence.jsonl <<'EOF'
{"type":"Claim","data":{"slug":"lower-latency","statement":"The migration reduced request latency."}}
{"type":"Source","data":{"slug":"load-test","title":"Load test report"}}
{"type":"Source","data":{"slug":"production-metrics","title":"Production metrics"}}
{"edge":"Supports","from":"load-test","to":"lower-latency"}
{"edge":"Supports","from":"production-metrics","to":"lower-latency"}
EOF
cat > queries.gq <<'EOF'
query sources_for_claim($claim: String) {
  match {
    $source: Source
    $claim_node: Claim { slug: $claim }
    $source supports $claim_node
  }
  return { $source.title as source }
  order { source asc }
}
EOF
omnigraph init --schema schema.pg graph.omni 2>&1; echo "init rc=$?"
omnigraph load --data evidence.jsonl --mode overwrite --target ./graph.omni 2>&1; echo "load rc=$?"
omnigraph query sources_for_claim --query queries.gq --params '{"claim":"lower-latency"}' --format table --target ./graph.omni 2>&1; echo "query rc=$?"
cd <guest-path> && cat docs/user/operations/mcp.md | head -150
cd <guest-path> && sed -n 1,200p docs/user/operations/server.md
export PATH=$HOME/.local/bin:$PATH; omnigraph-server --help 2>&1 | head -60; echo ----; cd <guest-path> && grep -n -i "uri boot\|--uri\|URI boot" docs/user/operations/server.md docs/user/cli/*.md docs/user/clusters/index.md | head -30; echo ----; sed -n 1,80p docs/user/cli/targets.md
cd <guest-path> && grep -n "^#" docs/user/clusters/index.md; echo ----; sed -n '/## Bootstrap a cluster/,/^## [A-Z]/p' docs/user/clusters/index.md | head -150
cd <guest-path> && sed -n 11,56p docs/user/clusters/index.md; echo ----; sed -n 201,232p docs/user/clusters/index.md
cd <guest-path> && grep -rl "applies_to" --include=*.md --include=*.yaml . | head -20; echo ----; sed -n 1,80p docs/user/operations/policy.md
cd <guest-path> && sed -n 80,140p docs/user/operations/policy.md
export PATH=$HOME/.local/bin:$PATH; mkdir -p /tmp/cb/company-brain/queries && cd /tmp/cb/company-brain && cat > cluster.yaml <<'EOF'
version: 1
metadata:
  name: company-brain
graphs:
  knowledge:
    schema: knowledge.pg
    queries: queries/
policies:
  cluster-access:
    file: cluster.policy.yaml
    applies_to: [cluster]
  graph-access:
    file: graph.policy.yaml
    applies_to: [knowledge]
EOF
cp /tmp/qs/schema.pg knowledge.pg
cat > queries/people.gq <<'EOF'
query sources_for_claim($claim: String) {
  match {
    $source: Source
    $claim_node: Claim { slug: $claim }
    $source supports $claim_node
  }
  return { $source.title as source }
  order { source asc }
}
EOF
cat > cluster.policy.yaml <<'EOF'
version: 1
groups:
  owners: [act-alice]
rules:
  - id: owners-manage-config
    allow:
      actors: { group: owners }
      actions: [config_manage]
  - id: owners-list-graphs
    allow:
      actors: { group: owners }
      actions: [graph_list]
EOF
cat > graph.policy.yaml <<'EOF'
version: 1
groups:
  readers: [act-alice]
rules:
  - id: readers-can-read
    allow:
      actors: { group: readers }
      actions: [read]
      branch_scope: any
  - id: readers-can-invoke
    allow:
      actors: { group: readers }
      actions: [invoke_query, change, schema_apply, branch_create, branch_merge]
EOF
omnigraph cluster validate --config /tmp/cb/company-brain 2>&1; echo "validate rc=$?"
mkdir -p /tmp/cb/out && omnigraph cluster plan --target /tmp/cb/company-data --config /tmp/cb/company-brain --as act-alice 2>&1; echo "plan rc=$?"
export PATH=$HOME/.local/bin:$PATH; mkdir -p /tmp/cb/company-data && cd /tmp/cb && omnigraph cluster plan --target /tmp/cb/company-data --config /tmp/cb/company-brain 2>&1; echo "plan rc=$?"; omnigraph cluster apply --target /tmp/cb/company-data --config /tmp/cb/company-brain --as act-alice --json 2>&1; echo "apply rc=$?"; ls -la /tmp/cb/company-data
export PATH=$HOME/.local/bin:$PATH; cd /tmp/cb && omnigraph --target file:///tmp/cb/company-data cluster force-unlock '01M5MVXH571C6J9F3XPTCKD76G' 2>&1; echo "unlock rc=$?"; (OMNIGRAPH_SERVER_BEARER_TOKENS_JSON='{"act-alice":"secret"}' nohup omnigraph-server --cluster /tmp/cb/company-data --bind 127.0.0.1:8080 > /tmp/cb/server.log 2>&1 &) ; sleep 8; curl -s -i http://127.0.0.1:8080/healthz | head -12; echo; curl -s -i http://127.0.0.1:8080/readyz | head -5; echo; tail -5 /tmp/cb/server.log
cd /tmp/cb && curl -s -X POST http://127.0.0.1:8080/mcp -H 'Authorization: <secret>' -H 'Omnigraph-Http-Api: 0.14' -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | head -c 3000; echo; echo ---; curl -s -X POST http://127.0.0.1:8080/mcp -H 'Authorization: <secret>' -H 'Omnigraph-Http-Api: 0.14' -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"access","arguments":{}}}' | head -c 1500
cd /tmp/cb && H=(-H 'Authorization: <secret>' -H 'Omnigraph-Http-Api: 0.14' -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream'); curl -s -X POST http://127.0.0.1:8080/mcp "${H[@]}" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | python3 -I -c 'import json,sys; d=json.load(sys.stdin); print([t["name"] for t in d["result"]["tools"]])'; echo ---; curl -s -X POST http://127.0.0.1:8080/mcp "${H[@]}" -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"schema","arguments":{"graph":"knowledge"}}}' | head -c 1200
echo "HOME=$HOME"; ls -la <guest-path> /inputs/coldpass-preflight.py 2>&1 | head; cd <guest-path> && grep -rn -i "cron\|--once\|--now\|interval\|tokio::time::interval\|schedule" README.md docs/user/cli/reference.md docs/user/operations/server.md 2>/dev/null | head -20; grep -rln "tokio::time::interval\|loop {" crates/*/src 2>/dev/null | head -10; ls <guest-path>
cd <guest-path> && sed -n 225,250p docs/user/cli/reference.md
pkill -f 'omnigraph-server --cluster /tmp/cb/company-data' ; sleep 3; pgrep -af omnigraph-server || echo "no server running"; mkdir -p /tmp/cb/gen && KEY=$(openssl rand -hex 16) && echo "$KEY" > /tmp/cb/gen/guest.key && cat > /tmp/cb/gen/mk.py <<'EOF'
import json, os, sys
key = open("/tmp/cb/gen/guest.key").read().strip()
W = "<guest-path>"
os.makedirs(W + "/.coldpass", exist_ok=True)
server = ["<guest-path>", "--cluster", "/tmp/cb/company-data", "--bind", "127.0.0.1:8080"]
env = {"OMNIGRAPH_SERVER_BEARER_TOKENS_JSON": json.dumps({"act-alice": key})}
headers = {"Authorization": "<secret>" + key, "Omnigraph-Http-Api": "0.14"}
mcp_args = {"graph": "knowledge"}
mcp_expect = "edge Supports: Source -> Claim"
probe = {"kind": "mcp_http", "argv": server, "cwd": W, "url": "http://127.0.0.1:8080/mcp",
         "env": env, "headers": headers, "tool": "schema", "arguments": mcp_args,
         "expected_text": mcp_expect}
claims = [
 {"kind": "claim",
  "claim": "The built-in MCP server lets an agent connect to a running omnigraph server and call its tools.",
  "source": "connect an agent to the server's `/mcp`",
  "input": "schema tool for graph knowledge",
  "expected": "returns the declared Supports edge",
  "probe_kind": "mcp_http", "argv": server, "url": "http://127.0.0.1:8080/mcp",
  "env": env, "headers": headers, "tool": "schema", "arguments": mcp_args,
  "expected_text": mcp_expect, "cwd": W},
 {"kind": "claim",
  "claim": "A --target ./graph.omni flag addresses a standalone local graph for querying.",
  "source": "Use `--target ./graph.omni` for a standalone local graph.",
  "input": "stored query sources_for_claim on the local quickstart graph",
  "expected": "returns the two source titles",
  "probe_kind": "cli",
  "argv": ["<guest-path>", "query", "sources_for_claim", "--query", "queries.gq",
           "--params", "{\"claim\":\"lower-latency\"}", "--format", "table", "--target", "./graph.omni"],
  "cwd": "/tmp/qs", "expected_text": "Load test report"},
]
examples = [
 {"kind": "example", "claim": "Validate a cluster bundle before deploying it",
  "source": "docs/user/clusters/index.md#bootstrap-a-cluster",
  "input": "/tmp/cb/company-brain", "expected": "cluster config valid",
  "argv": ["<guest-path>", "cluster", "validate", "--config", "/tmp/cb/company-brain"],
  "cwd": W, "env": {}, "expected_text": "cluster config valid"},
 {"kind": "example", "claim": "Quickstart query returns the two sources supporting the claim",
  "source": "docs/user/quickstart.md#4-query",
  "input": "sources_for_claim lower-latency", "expected": "Load test report and Production metrics",
  "argv": ["<guest-path>", "query", "sources_for_claim", "--query", "queries.gq",
           "--params", "{\"claim\":\"lower-latency\"}", "--format", "table", "--target", "./graph.omni"],
  "cwd": "/tmp/qs", "env": {}, "expected_text": "Production metrics"},
]
cycles = {"detected": False,
  "reason": "Entry points inspected (README.md, docs/user/operations/server.md, docs/user/cli/reference.md, crates/*/src). omnigraph and omnigraph-server run on demand: a CLI command or a long-running request server with no internal scheduler, cron, --once or --now trigger. The only polling (two-second interval, reference.md) is a client-side wait for managed-cloud deployments, which this local setup does not use.",
  "checks": []}
def w(name, obj):
    with open(os.path.join(W, ".coldpass", name), "w") as f:
        json.dump(obj, f, indent=2); f.write("\n")
w("probe.json", probe); w("claims.json", claims); w("examples.json", examples); w("cycles.json", cycles)
print("written")
EOF
python3 -I /tmp/cb/gen/mk.py && ls -la <guest-path> && cat <guest-path>
pkill -f 'omnigraph-server --cluster /tmp/cb/company-[d]ata'; sleep 3; (pgrep -af 'omnigraph-server --cluster' | grep -v pgrep) || echo "no server running"; ls /tmp/cb/gen 2>/dev/null; ls -la <guest-path>
mkdir -p /tmp/cb/gen && openssl rand -hex 16 > /tmp/cb/gen/guest.key && cat > /tmp/cb/gen/mk.py <<'EOF'
import json, os
key = open("/tmp/cb/gen/guest.key").read().strip()
W = "<guest-path>"
os.makedirs(W + "/.coldpass", exist_ok=True)
server = ["<guest-path>", "--cluster", "/tmp/cb/company-data", "--bind", "127.0.0.1:8080"]
env = {"OMNIGRAPH_SERVER_BEARER_TOKENS_JSON": json.dumps({"act-alice": key})}
headers = {"Authorization": "<secret>" + key, "Omnigraph-Http-Api": "0.14"}
mcp_args = {"graph": "knowledge"}
mcp_expect = "edge Supports: Source -> Claim"
probe = {"kind": "mcp_http", "argv": server, "cwd": W, "url": "http://127.0.0.1:8080/mcp",
         "env": env, "headers": headers, "tool": "schema", "arguments": mcp_args,
         "expected_text": mcp_expect}
claims = [
 {"kind": "claim",
  "claim": "The built-in MCP server lets an agent connect to a running omnigraph server and call its tools.",
  "source": "connect an agent to the server's `/mcp`",
  "input": "schema tool for graph knowledge",
  "expected": "returns the declared Supports edge",
  "probe_kind": "mcp_http", "argv": server, "url": "http://127.0.0.1:8080/mcp",
  "env": env, "headers": headers, "tool": "schema", "arguments": mcp_args,
  "expected_text": mcp_expect, "cwd": W},
 {"kind": "claim",
  "claim": "A --target ./graph.omni flag addresses a standalone local graph for querying.",
  "source": "Use `--target ./graph.omni` for a standalone local graph.",
  "input": "stored query sources_for_claim on the local quickstart graph",
  "expected": "returns the two source titles",
  "probe_kind": "cli",
  "argv": ["<guest-path>", "query", "sources_for_claim", "--query", "queries.gq",
           "--params", "{\"claim\":\"lower-latency\"}", "--format", "table", "--target", "./graph.omni"],
  "cwd": "/tmp/qs", "expected_text": "Load test report"},
]
examples = [
 {"kind": "example", "claim": "Validate a cluster bundle before deploying it",
  "source": "docs/user/clusters/index.md#bootstrap-a-cluster",
  "input": "/tmp/cb/company-brain", "expected": "cluster config valid",
  "argv": ["<guest-path>", "cluster", "validate", "--config", "/tmp/cb/company-brain"],
  "cwd": W, "env": {}, "expected_text": "cluster config valid"},
 {"kind": "example", "claim": "Quickstart query returns the two sources supporting the claim",
  "source": "docs/user/quickstart.md#4-query",
  "input": "sources_for_claim lower-latency", "expected": "Load test report and Production metrics",
  "argv": ["<guest-path>", "query", "sources_for_claim", "--query", "queries.gq",
           "--params", "{\"claim\":\"lower-latency\"}", "--format", "table", "--target", "./graph.omni"],
  "cwd": "/tmp/qs", "env": {}, "expected_text": "Production metrics"},
]
cycles = {"detected": False,
  "reason": "Entry points inspected (README.md, docs/user/operations/server.md, docs/user/cli/reference.md, crates/*/src). omnigraph and omnigraph-server run on demand: a CLI command or a long-running request server with no internal scheduler, cron, --once or --now trigger. The only polling (two-second interval, reference.md) is a client-side wait for managed-cloud deployments, which this local setup does not use.",
  "checks": []}
def w(name, obj):
    with open(os.path.join(W, ".coldpass", name), "w") as f:
        json.dump(obj, f, indent=2); f.write("\n")
w("probe.json", probe); w("claims.json", claims); w("examples.json", examples); w("cycles.json", cycles)
print("written")
EOF
python3 -I /tmp/cb/gen/mk.py && ls -la <guest-path> && python3 -I -c "import json;print(json.load(open('<guest-path>'))['tool'])"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
cat > /tmp/cb/gen/report.py <<'EOF'
import json
report = {
 "outcome": "working",
 "fault_owner": None,
 "operation": "Install omnigraph 0.14.0 with the README installer, create and load a local graph, query it, and serve a graph over the built-in MCP endpoint (tool schema on graph knowledge).",
 "operation_scope": "Linux x86_64 Ubuntu 24.04 guest, user ubuntu (uid 1000), Python 3.12.3. Uses the published stable release binaries installed by the README installer; no source build. The MCP check runs a local streamable-HTTP omnigraph-server on 127.0.0.1:8080 with a static bearer token. Not tested: managed/cloud targets, S3 or Azure storage, OIDC, signed data tokens, writes over MCP, the stdio bridge (omnigraph mcp).",
 "steps": [
  "curl -fsSL https://raw.githubusercontent.com/ModernRelay/omnigraph/main/scripts/install.sh | bash (run as a saved file, NODE_USE_ENV_PROXY=1 exported); installed omnigraph and omnigraph-server 0.14.0",
  "omnigraph init --schema schema.pg graph.omni",
  "omnigraph load --data evidence.jsonl --mode overwrite --target ./graph.omni",
  "omnigraph query sources_for_claim --query queries.gq --params '{\"claim\":\"lower-latency\"}' --format table --target ./graph.omni",
  "omnigraph cluster validate --config /tmp/cb/company-brain",
  "omnigraph cluster plan --target /tmp/cb/company-data --config /tmp/cb/company-brain (after mkdir -p /tmp/cb/company-data, as the README's mkdir -p ./company-data step)",
  "omnigraph cluster apply --target /tmp/cb/company-data --config /tmp/cb/company-brain --as act-alice --json",
  "omnigraph --target file:///tmp/cb/company-data cluster force-unlock <exact lock ID printed by apply>",
  "OMNIGRAPH_SERVER_BEARER_TOKENS_JSON='{\"act-alice\":\"<guest key>\"}' omnigraph-server --cluster /tmp/cb/company-data --bind 127.0.0.1:8080",
  "POST /mcp tools/call schema {\"graph\":\"knowledge\"} returned: edge Supports: Source -> Claim",
  "python3 -I <guest-path> --validate --replay (<env-var> set): valid, no problems, replay PASS"
 ],
 "deviations": [
  "The README's build and test commands (cargo build --workspace --locked; cargo test ...) were not run. cargo is not installed in the guest and the Rust 1.97.1 toolchain pinned in rust-toolchain.toml was not installed. Building the whole workspace was not done; the README's published-binary install path was used instead.",
  "The installed binaries are the published stable release 0.14.0 (server reports source_version 60bfd19db780fdff3a5178f959c1204143420114), not a build of the pinned commit 1ec9b32e60b678329c35468220f85344f1940faf. Git metadata was not set up because no step needed it; the snapshot in <guest-path> has no .git directory, and the pin was not fetched or checked against it.",
  "The installer put files under <guest-path> (HOME is <guest-path>), not ~/.local/bin as the README states. Probes and claims use the absolute path.",
  "The first cluster plan failed with storage_root_invalid because the storage root directory did not exist. Fixed by creating it with mkdir -p as the README does; the storage root is the apply target, not a checker output.",
  "cluster apply took an admission lock (01M5MVXH571C6J9F3XPTCKD76G). Released it with the exact-ID force-unlock command from docs/user/clusters/index.md after confirming no other writer was running, then started the server.",
  "The README's /inputs/coldpass-preflight.py path does not exist in this guest; the checker at <guest-path> was used with the same flags.",
  "The MCP and cluster-bundle policies were written by hand (small examples based on docs/user/operations/policy.md and clusters/index.md) because no ready-made example bundle was found in the repository.",
  "The README's Build and test section is recorded as an example with a reason rather than run."
 ],
 "stuck_step": None,
 "main_blocker": None,
 "plain_failure": None,
 "suggested_fix": "None for the tested path. Optional: run the README's cargo build and test commands with the pinned Rust toolchain in a guest with enough disk and time, and confirm the release binaries match the pinned commit."
}
with open("<guest-path>", "w") as f:
    json.dump(report, f, indent=2); f.write("\n")
print("report written")
EOF
python3 -I /tmp/cb/gen/report.py && (pgrep -af 'omnigraph-server' | grep -v pgrep || echo "no omnigraph-server running") && cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import json,sys; d=json.loads(sys.stdin.read()); print("valid:",d["valid"]); print("problems:",d["problems"]); print("replay:",d["replay"]["status"])'; ls -la <guest-path>
cd <guest-path>; . /etc/os-release; echo "$PRETTY_NAME"; uname -m; python3 --version; ls -d .git 2>/dev/null || echo "no .git"; <guest-path> --version; <guest-path> --version 2>&1 | head -3; cat .coldpass/probe.json; echo; cat .coldpass/observed.json | head -c 1500; echo; grep -n "init\|load --\|query " <guest-path> | head -20
cd /tmp/cb/gen && python3 -I - <<'EOF'
import json
p="<guest-path>"
r=json.load(open(p))
r["operation_scope"]="Linux x86_64, Ubuntu 24.04.5 LTS, Python 3.12.3, user ubuntu. Uses the published 0.14.0 release binaries installed by the README installer (no source build). The MCP check runs a local streamable-HTTP omnigraph-server on 127.0.0.1:8080 with a static bearer token. Not tested: managed/cloud targets, S3 or Azure storage, OIDC, writes over MCP, the stdio bridge (omnigraph mcp)."
r["steps"][0]="curl -fsSL https://raw.githubusercontent.com/ModernRelay/omnigraph/main/scripts/install.sh | bash (saved to /tmp/install-omnigraph.sh and run with bash); installed omnigraph 0.14.0 and omnigraph-server"
r["deviations"][1]="The installed binaries are the published 0.14.0 release, not a build of the pinned commit 1ec9b32e60b678329c35468220f85344f1940faf. The workspace has no .git directory, so the pin was not checked against the installed binaries."
r["deviations"]=[d for d in r["deviations"] if "Git metadata was not set up" not in d]
r["deviations"].append("The 'omnigraph --version' output reports 0.14.0; omnigraph-server does not accept --version, so its version was taken from the serverInfo in the MCP initialize response.")
json.dump(r,open(p,"w"),indent=2); open(p,"a").write("\n")
print("ok")
EOF
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import json,sys; d=json.loads(sys.stdin.read()); print("valid:",d["valid"]); print("problems:",d["problems"]); print("replay:",d["replay"]["status"])'; pgrep -af omnigraph-server | grep -v pgrep || echo "no omnigraph-server running"