Semantica

Summary

Graph-Native Infrastructure for Context and Accountable AI Systems

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v0.6.7 Aug 28, 2026 · issue 012

   Semantica v0.6.7 adds LangChain integration, SAP ODataODataAn open protocol, standardized by OASIS, for building and consuming queryable REST APIs using URL conventions and a common metadata format that lets clients filter, sort, and page results without custom query logic on the server side. ingestor, public SHACL validation API, reasoning Action layer, and ContextGraph Markdown persistence.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.6.7 https://github.com/semantica-agi/semantica.git
   # already have the repo? check out this version:
   $ git checkout v0.6.7

   └──▷ USE IT
   Validate a populated knowledge graph against SHACL constraints to surface policy violations before an audit export.
   python copy

   from semantica.ontology import run_shacl_validation
   
   results = run_shacl_validation(graph)
   for violation in results:
       print(violation)

   Install Semantica with SAP OData ingestion support to pull enterprise data directly into a knowledge graph.
   copy

   $ pip install 'semantica[ingest-sap]'

   Install Semantica with LangChain integration to wire agent pipelines into graph-native context and provenance.
   copy

   $ pip install 'semantica[langchain]'

   • ›Adds run_shacl_validation as a public API for programmatic SHACL constraint validation against a graph.
   • ›Adds semantica[langchain] extras install for first-class LangChain integration.
   • ›Adds semantica[ingest-sap] extras install for a new SAP OData ingestor.
   • ›Adds ContextGraph Markdown round-trip persistence — graphs can now be serialized to and loaded from Markdown.
   • ›Adds a reasoning Action layer supporting rule-driven Assert, Retract, Call, and EmitEvent actions with optional provenance tracking.
   +1 moreshow less

   • ›Adds a read-only Markdown content viewer and source view to the Explorer UI.
2. v0.6.6 Aug 20, 2026 · issue 012

   Semantica v0.6.6 adds CrewAI integration, ContextGraph retraction/purge, an allow_private_ips seed opt-in, and a metric_errors export column.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.6.6 https://github.com/semantica-agi/semantica.git
   # already have the repo? check out this version:
   $ git checkout v0.6.6

   • ›Adds allow_private_ips opt-in to seed ingestion, enabling trusted internal API sources to bypass the default SSRF guard.
   • ›Adds opt-in metric_errors column to DistanceExporter to surface metric computation failures in export output.
   • ›Adds retraction and purge methods to ContextGraph for removing facts from the graph.
   • ›Introduces a declared Semantica RDF vocabulary with deterministic entity/relationship IRIs.
   • ›Adds timezone-aware timestamps across export/ and provenance/ modules.
3. v0.6.5 Aug 11, 2026 · issue 012

   Semantica v0.6.5 adds embedded Oxigraph TripletStore, Altair Anzo backend, PROV-O completeness, and Markdown AgentMemory export alongside critical security hardening.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v0.6.5 https://github.com/semantica-agi/semantica.git
   # already have the repo? check out this version:
   $ git checkout v0.6.5

   └──▷ TRY IT
   Use the embedded Oxigraph backend to run a SPARQL 1.1 store in-process without standing up Blazegraph, Jena, or RDF4J.
   copy

   $ pip install 'semantica[tripletstore-oxigraph]'

   Lock down the Explorer API in a production deployment by requiring an API key, while keeping anonymous access available in a local dev environment.
   copy

   $ # production
   export SEMANTICA_API_KEY=your-secret-key
   
   # local dev only — explicit opt-out of auth
   export SEMANTICA_ALLOW_ANONYMOUS=true

   • ›Adds embedded Oxigraph backend for TripletStore via pip install 'semantica[tripletstore-oxigraph]' — runs in-process with pyoxigraph, no external SPARQL server required; persists to a local directory or runs in memory.
   • ›Adds SEMANTICA_API_KEY enforcement via Depends(require_auth) on X-API-Key across all 11 Explorer API routers; fails closed with 503 when unset. SEMANTICA_ALLOW_ANONYMOUS=true remains available as an explicit opt-out for local/dev use.
   • ›Adds SEMANTICA_ALLOW_ANONYMOUS=true environment variable as an explicit opt-in for unauthenticated Explorer API access (local/dev deployments), replacing the previous silent anonymous-allow behavior.
   • ›Adds new CLI commands semantica provenance invalidate, semantica provenance verify-chain, and semantica provenance descendants for PROV-O trust and integrity operations.
   • ›Adds Altair Anzo triplet store backend — a fourth peer to Blazegraph/RDF4J/Jena, speaking plain SPARQL 1.1 over HTTP with no new dependency required.
   +12 moreshow less

   • ›Adds shared validate_url_for_request() SSRF guard wired into WebIngestor, SitemapCrawler, and RESTIngestor; allow_private_ips opt-in remains available for trusted internal deployments.
   • ›Adds shared semantica/graph_store/query_sanitize.py to validate every Cypher label, relationship-type, and property-key interpolation site across the Neptune, Neo4j, and FalkorDB backends.
   • ›Adds sparql_escaping.validate_uri() at every IRI interpolation site across the Blazegraph, RDF4J, and Jena backends to block SPARQL injection.
   • ›Adds Markdown round-trip export/import for AgentMemory — human-editable, diff-friendly alternative to JSON serialization, with atomic upsert-by-ID import.
   • ›Adds full PROV-O completeness to ProvenanceManager: invalidation-instead-of-delete tombstoning, hash-chained integrity via verify_chain(), typed Agent/Activity records, downstream lineage traversal, W3C PROV-O qualified relations, bitemporal and Bundle support, and a configurable namespace.
   • ›Adds global default persistent SQLite storage for ProvenanceManager — every ingestion module now persists to the audit trail instead of silently falling back to in-memory storage.
   • ›Replaces pickle.load() in VectorStore.save()/load() with JSON serialization; legacy .pkl files are now refused rather than deserialized.
   • ›Adds defusedxml as a declared dependency and uses _safe_parse_rdf() to prevent XXE in the RDF/XML parser; fails closed if defusedxml is not importable.
   • ›Adds a 50,000 node/edge cap on SPARQL graph materialization to prevent unbounded DoS.
   • ›Adds Origin validation on the /ws/graph-updates WebSocket handshake, checked against the same allowlist already enforced by CORSMiddleware for HTTP.
   • ›Adds a 10,000-character defense-in-depth query length cap on the SPARQL route alongside a rewritten _PREFIX_DECL regex to close a polynomial-time ReDoS path.
   • ›Adds SLSA build provenance attestation and a protected pypi GitHub Environment; all third-party GitHub Actions across 8 workflows are now pinned to full commit SHAs with a CI check that fails closed on any non-SHA uses: reference.
   └──▷ BREAKING ON UPGRADE

   • !The Explorer API now fails closed with HTTP 503 on all 11 routers when SEMANTICA_API_KEY is unset — previously all routes were reachable with no credential. Deployments that relied on anonymous access must set SEMANTICA_ALLOW_ANONYMOUS=true explicitly.
   • !Legacy .pkl files produced by VectorStore.save() are now refused on load; the format has changed to JSON and old pickle files must be regenerated.