context-graph-spaces

The Enterprise edition of Context Graph: memory for many users on one shared, licensed Memgraph. Each user gets a personal space, and teams get shared spaces. Memgraph Enterprise enforces the isolation through multi-tenancy, role-based access control and label- and property-based access control. Our code doesn't filter.

The Community edition (one user, one database) doesn't need this package and doesn't change when it's installed. A user's config file selects Enterprise explicitly:

edition = "enterprise"

[memgraph]
url = "bolt://memgraph.corp:7687"
user = "ante"        # your Memgraph login is your identity
password = "..."

For admins: provisioning

Spaces are declared in a spec file and applied idempotently:

members = ["ante", "bob"]
personal_memory_limit_mb = 2048

[spaces.payments]
members = ["ante", "bob"]
memory_limit_mb = 4096
# labels = [...]       # what members may write; defaults to curated memory
# edge_types = [...]

export MEMGRAPH_URL=bolt://memgraph.corp:7687 MEMGRAPH_USER=<admin> MEMGRAPH_PASSWORD=...
context-graph-spaces plan spaces.toml     # what would change
context-graph-spaces apply spaces.toml    # make it so; prints one-time setup lines for new logins

What apply maintains:

Removing someone from the spec revokes their access. Removing a space revokes access to it. Users and databases are only dropped with --prune. Only objects with the u_, space_ and cg_ prefixes are ever touched.

The shared-space worker

Members can write only curated memory into a shared space. The derived graph there (chunks, entities, relations, and the embeddings recall uses) is written by one service login, cg_service. Run the worker next to apply, with the password apply printed once:

export CG_SERVICE_PASSWORD=...
context-graph-spaces reconcile spaces.toml --watch     # one pass every 30s

Each pass, for each shared space, it does two things:

1. It removes what deleted files left behind. A member's delete can't touch chunks.
2. It reconciles changed memory files with GLiNER2 under the space's ontology. No LLM is involved.

Personal spaces keep reconciling locally, as in Community.

Tests

The tests run end-to-end against a licensed Memgraph. The licence is read from MEMGRAPH_ENTERPRISE_LICENSE and MEMGRAPH_ORGANIZATION_NAME (the repo's .env locally, secrets in CI):

./scripts/dev-memgraph.sh test-enterprise