omnigraph/docs/user/audit.md
aaltshuler fa6af775c1 feat(cli)!: unified load command; deprecate ingest as an alias
omnigraph load is now the single data-write command:
- works against remote graphs (POSTs the server's /ingest endpoint with the
  same bearer/actor resolution as other remote commands) — previously load
  was the only data command forced to open Lance storage directly
- --from <base> opts into fork-if-missing for --branch (the former ingest
  semantics); without --from a missing branch is an error, never a fork
- --mode is now required: overwrite is destructive, so there is no implicit
  default (the old silent default was overwrite)
- output gains base_branch/branch_created (and table sums on remote loads)

omnigraph ingest stays as a deprecated alias (defaults preserved: --from
main --mode merge) that prints a one-line warning to stderr, matching the
read/change deprecation convention; removal in a later release.

Docs updated in the same change: cli.md, cli-reference.md, policy.md,
audit.md, execution.md (unified load section), AGENTS.md quick-flow,
README.md.

BREAKING CHANGE: scripts running omnigraph load without --mode must now
pass it explicitly (previously defaulted to the destructive overwrite).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-11 04:18:00 +03:00

943 B

Audit / Actor tracking

  • Omnigraph::audit_actor_id: Option<String> is the actor in effect.
  • _as variants of every write API let callers override the actor: mutate_as, load_as, branch_merge_as, apply_schema_as, etc.
  • Actor IDs are persisted on GraphCommit.actor_id with split storage in _graph_commit_actors.lance (the commit graph is split into _graph_commits.lance for the linkage and _graph_commit_actors.lance for the actor map).
  • HTTP server uses the bearer-token actor automatically; CLI uses the local user / explicit env (no implicit actor).
  • Pre-v0.4.0 graphs also stored actor IDs on RunRecord.actor_id in _graph_runs.lance / _graph_run_actors.lance. The Run state machine was removed in MR-771; those files are inert post-v0.4.0. The v2→v3 manifest migration sweeps any stale __run__* branches on first write-open (MR-770); the inert dataset bytes remain until a delete_prefix primitive lands.