superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/core/consolidation_engine.py

@@ -49,6 +49,59 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
+def _recompute_entity_communities(
+    db: Any, profile_id: str, summarizer: Any = None,
+) -> dict[str, int]:
+    """Wave Q: rebuild the entity-community backbone + summaries (fail-open).
+
+    Shared spine for Q2 community summaries and Q3 progressive abstraction.
+    Runs in the background consolidation lane; never blocks store/recall.
+    Community detection and summary generation are independently fail-open.
+    """
+    result: dict[str, int] = {"entity_count": 0, "community_count": 0}
+    try:
+        from superlocalmemory.core.entity_community import EntityCommunityBuilder
+
+        result = EntityCommunityBuilder(db).compute_and_store(profile_id)
+        logger.info(
+            "Background entity-community: %d entities, %d communities",
+            result.get("entity_count", 0),
+            result.get("community_count", 0),
+        )
+    except Exception as exc:
+        logger.debug("Entity-community recompute failed (non-fatal): %s", exc)
+        return result
+
+    # Wave Q2: one synthesized report per community (rides on the backbone).
+    try:
+        from superlocalmemory.core.community_summary import CommunitySummaryBuilder
+
+        summ = CommunitySummaryBuilder(db, summarizer=summarizer).compute_and_store(
+            profile_id,
+        )
+        result["summaries_written"] = summ.get("summaries_written", 0)
+        logger.info(
+            "Background community summaries: %d written",
+            summ.get("summaries_written", 0),
+        )
+    except Exception as exc:
+        logger.debug("Community summaries failed (non-fatal): %s", exc)
+
+    # Wave Q3: persona roll-up (top tier over the community summaries).
+    try:
+        from superlocalmemory.core.progressive_abstraction import (
+            ProgressiveAbstraction,
+        )
+
+        pa = ProgressiveAbstraction(db, summarizer=summarizer).compute_and_store(
+            profile_id,
+        )
+        result["persona_built"] = bool(pa.get("built", False))
+    except Exception as exc:
+        logger.debug("Persona roll-up failed (non-fatal): %s", exc)
+    return result
+
+
 class ConsolidationEngine:
     """Sleep-time memory consolidation with 6-step cycle.
 
@@ -254,21 +307,27 @@ class ConsolidationEngine:
         activation. Takes ~200-800ms, runs on daemon thread, zero impact
         on store/recall latency.
         """
-        if self._graph_analyzer is None:
-            return
         analyzer = self._graph_analyzer
         pid = profile_id
+        db = self._db
+        summarizer = self._summarizer
 
         def _run() -> None:
-            try:
-                result = analyzer.compute_and_store(pid)
-                logger.info(
-                    "Background graph analysis complete: %d nodes, %d communities",
-                    result.get("node_count", 0),
-                    result.get("community_count", 0),
-                )
-            except Exception as exc:
-                logger.debug("Background graph analysis failed (non-fatal): %s", exc)
+            if analyzer is not None:
+                try:
+                    result = analyzer.compute_and_store(pid)
+                    logger.info(
+                        "Background graph analysis complete: %d nodes, "
+                        "%d communities",
+                        result.get("node_count", 0),
+                        result.get("community_count", 0),
+                    )
+                except Exception as exc:
+                    logger.debug(
+                        "Background graph analysis failed (non-fatal): %s", exc,
+                    )
+            # Wave Q: entity-community backbone + summaries (Q2/Q3 spine).
+            _recompute_entity_communities(db, pid, summarizer)
 
         t = threading.Thread(target=_run, daemon=True, name="graph-analysis-bg")
         t.start()
@@ -510,15 +569,21 @@ class ConsolidationEngine:
                 fact_id, profile_id,
             )
 
-        # Fallback: direct SQL check
+        # Fallback: direct SQL check. Must consider BOTH valid_until (valid-time
+        # expiry) AND system_expired_at (transaction-time expiry) — a fact that
+        # was invalidated/erased sets system_expired_at, and ignoring it would
+        # let a GDPR-erased/superseded fact be promoted back into warm lifecycle.
         rows = self._db.execute(
-            "SELECT valid_until FROM fact_temporal_validity "
+            "SELECT valid_until, system_expired_at FROM fact_temporal_validity "
             "WHERE fact_id = ? AND profile_id = ?",
             (fact_id, profile_id),
         )
         if not rows:
             return True  # No temporal record = valid
-        valid_until = dict(rows[0]).get("valid_until")
+        row = dict(rows[0])
+        if row.get("system_expired_at") is not None:
+            return False  # transaction-time expired (invalidated/erased)
+        valid_until = row.get("valid_until")
         if valid_until is None:
             return True  # Open-ended validity
         try:
@@ -555,14 +620,22 @@ class ConsolidationEngine:
     def _step5_recompute_graph(
         self, profile_id: str,
     ) -> dict[str, Any]:
-        """Recompute PageRank + communities.  Delegates to GraphAnalyzer."""
-        if self._graph_analyzer is None:
-            return {"node_count": 0, "community_count": 0}
-        try:
-            return self._graph_analyzer.compute_and_store(profile_id)
-        except Exception as exc:
-            logger.warning("Graph recompute failed: %s", exc)
-            return {"node_count": 0, "community_count": 0}
+        """Recompute PageRank + communities.  Delegates to GraphAnalyzer.
+
+        Wave Q: also rebuilds the entity-community backbone (Q2/Q3 spine).
+        """
+        result: dict[str, Any] = {"node_count": 0, "community_count": 0}
+        if self._graph_analyzer is not None:
+            try:
+                result = self._graph_analyzer.compute_and_store(profile_id)
+            except Exception as exc:
+                logger.warning("Graph recompute failed: %s", exc)
+        ec = _recompute_entity_communities(
+            self._db, profile_id, self._summarizer,
+        )
+        result["entity_community_count"] = ec.get("community_count", 0)
+        result["community_summaries"] = ec.get("summaries_written", 0)
+        return result
 
     # ------------------------------------------------------------------
     # Step 6: Derive Associations

package/src/superlocalmemory/core/context_cache.py

@@ -65,6 +65,18 @@ class CacheEntry:
     provenance: str = "tool_observation"
     computed_at: int = 0
     byte_size: int = 0
+    profile_id: str = "default"
+
+
+def _active_profile_fallback(home: Path) -> str:
+    """Resolve the active profile for the cache reader hot path (stdlib only,
+    never raises). Two profiles can share a session_id, so cached context MUST
+    be keyed by profile or one tenant reads another's context."""
+    try:
+        raw = (home / "profiles.json").read_text(encoding="utf-8")
+        return json.loads(raw).get("active_profile", "default") or "default"
+    except Exception:
+        return "default"
 
 
 # ---------------------------------------------------------------------------
@@ -199,9 +211,24 @@ class ContextCache:
         return conn
 
     def _bootstrap_schema_and_meta(self) -> None:
+        # Isolation: cached context is keyed by profile so two tenants sharing a
+        # session_id cannot read each other's context. Older cache files lack
+        # the profile_id column — the cache is ephemeral (120s TTL), so drop and
+        # recreate rather than run a rebuild migration.
+        try:
+            cols = {
+                r[1] for r in self._write_conn.execute(
+                    "PRAGMA table_info(context_entries)"
+                ).fetchall()
+            }
+            if cols and "profile_id" not in cols:
+                self._write_conn.execute("DROP TABLE context_entries")
+        except sqlite3.Error:  # pragma: no cover — defensive
+            pass
         self._write_conn.executescript(
             """
             CREATE TABLE IF NOT EXISTS context_entries (
+                profile_id  TEXT NOT NULL DEFAULT 'default',
                 session_id  TEXT NOT NULL,
                 topic_sig   TEXT NOT NULL,
                 content     TEXT NOT NULL,
@@ -209,11 +236,11 @@ class ContextCache:
                 provenance  TEXT NOT NULL DEFAULT 'tool_observation',
                 computed_at INTEGER NOT NULL,
                 byte_size   INTEGER NOT NULL,
-                PRIMARY KEY (session_id, topic_sig)
+                PRIMARY KEY (profile_id, session_id, topic_sig)
             ) WITHOUT ROWID;
 
             CREATE INDEX IF NOT EXISTS idx_ctx_session_time
-                ON context_entries(session_id, computed_at);
+                ON context_entries(profile_id, session_id, computed_at);
             CREATE INDEX IF NOT EXISTS idx_ctx_time
                 ON context_entries(computed_at);
 
@@ -263,26 +290,38 @@ class ContextCache:
         self._write_conn.execute(
             """
             INSERT OR REPLACE INTO context_entries
-                (session_id, topic_sig, content, fact_ids,
+                (profile_id, session_id, topic_sig, content, fact_ids,
                  provenance, computed_at, byte_size)
-            VALUES (?, ?, ?, ?, ?, ?, ?)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)
             """,
-            (entry.session_id, entry.topic_sig, content, fact_ids_json,
-             entry.provenance, computed_at, byte_size),
+            (entry.profile_id or "default", entry.session_id, entry.topic_sig,
+             content, fact_ids_json, entry.provenance, computed_at, byte_size),
         )
 
     # -- Cleanup ------------------------------------------------------------
 
     def cleanup_session(
         self, session_id: str, *, older_than: int = CLEANUP_HORIZON_SECONDS,
+        profile_id: str | None = None,
     ) -> int:
-        """Delete rows for ``session_id`` older than ``older_than`` seconds."""
+        """Delete rows for ``session_id`` older than ``older_than`` seconds.
+
+        When ``profile_id`` is given the delete is tenant-scoped so a cleanup on
+        a shared session_id cannot wipe another profile's cached context.
+        """
         cutoff = int(time.time()) - older_than
-        cur = self._write_conn.execute(
-            "DELETE FROM context_entries "
-            "WHERE session_id=? AND computed_at < ?",
-            (session_id, cutoff),
-        )
+        if profile_id is not None:
+            cur = self._write_conn.execute(
+                "DELETE FROM context_entries "
+                "WHERE profile_id=? AND session_id=? AND computed_at < ?",
+                (profile_id, session_id, cutoff),
+            )
+        else:
+            cur = self._write_conn.execute(
+                "DELETE FROM context_entries "
+                "WHERE session_id=? AND computed_at < ?",
+                (session_id, cutoff),
+            )
         return cur.rowcount
 
     def cleanup_global_lru(self) -> int:
@@ -309,17 +348,17 @@ class ContextCache:
         target = int(MAX_BYTES * 0.9)
         while total > target:
             rows = self._write_conn.execute(
-                "SELECT session_id, topic_sig, byte_size "
+                "SELECT profile_id, session_id, topic_sig, byte_size "
                 "FROM context_entries "
                 "ORDER BY computed_at ASC LIMIT 100",
             ).fetchall()
             if not rows:  # pragma: no cover — reached only if table empties mid-sweep
                 break
-            for sess, sig, size in rows:
+            for pid, sess, sig, size in rows:
                 self._write_conn.execute(
                     "DELETE FROM context_entries "
-                    "WHERE session_id=? AND topic_sig=?",
-                    (sess, sig),
+                    "WHERE profile_id=? AND session_id=? AND topic_sig=?",
+                    (pid, sess, sig),
                 )
                 deleted += 1
                 total -= size
@@ -345,6 +384,7 @@ def read_entry_fast(
     *,
     db_path: Path | None = None,
     home_dir: Path | None = None,
+    profile_id: str | None = None,
 ) -> CacheEntry | None:
     """Hot-path reader used by the UserPromptSubmit hook.
 
@@ -397,14 +437,17 @@ def read_entry_fast(
                 return None
 
             now = int(time.time())
+            # Scope to the active profile so a shared session_id cannot read
+            # another tenant's cached context.
+            pid = profile_id or _active_profile_fallback(home)
             row = conn.execute(
                 """
                 SELECT content, fact_ids, provenance, computed_at, byte_size
                 FROM context_entries
-                WHERE session_id=? AND topic_sig=?
+                WHERE profile_id=? AND session_id=? AND topic_sig=?
                   AND computed_at > ?
                 """,
-                (session_id, topic_sig, now - TTL_SECONDS),
+                (pid, session_id, topic_sig, now - TTL_SECONDS),
             ).fetchone()
         finally:
             try:

package/src/superlocalmemory/core/embedding_worker.py

@@ -65,6 +65,21 @@ def _embedding_backend_order() -> tuple[str, str]:
     return ("onnx", "pytorch")
 
 
+# H-02 (3.7.9): trust_remote_code=_trusts_remote_code(name) runs arbitrary Python from the model
+# repository at load time. Restrict it to the pinned models SLM ships that
+# genuinely need custom modeling code (nomic-embed). Any other model — including
+# one swapped into config by a write-path attacker — loads with
+# trust_remote_code=False and therefore cannot execute repo code.
+_TRUSTED_REMOTE_CODE_MODELS = frozenset({
+    "nomic-ai/nomic-embed-text-v1.5",
+    "nomic-ai/nomic-embed-text-v1",
+})
+
+
+def _trusts_remote_code(model_name: str) -> bool:
+    return model_name in _TRUSTED_REMOTE_CODE_MODELS
+
+
 def _load_embedding_model(name: str) -> tuple:
     """Load embedding model. ONNX CPU-only first, PyTorch fallback.
 
@@ -84,14 +99,14 @@ def _load_embedding_model(name: str) -> tuple:
                 m = SentenceTransformer(
                     name,
                     backend="onnx",
-                    trust_remote_code=True,
+                    trust_remote_code=_trusts_remote_code(name),
                     model_kwargs={"provider": "CPUExecutionProvider"},
                 )
             else:
                 import torch
                 with torch.inference_mode():
                     m = SentenceTransformer(
-                        name, trust_remote_code=True, device="cpu",
+                        name, trust_remote_code=_trusts_remote_code(name), device="cpu",
                     )
             return m, backend
         except Exception:

package/src/superlocalmemory/core/embeddings.py

@@ -295,7 +295,13 @@ class EmbeddingService:
         never hangs indefinitely on cold model loads or network issues.
         """
         with self._lock:
-            if not self._available:
+            # Only an explicit terminal disable (``False``) short-circuits. A
+            # ``None`` availability is the recall-health self-heal's "re-probe"
+            # signal (recall_health._heal_embedder) — it must fall through and
+            # respawn the worker, matching OllamaEmbedder's tri-state
+            # convention. Using ``not self._available`` here bricked the local
+            # worker on the first heal tick, because ``None`` is falsy.
+            if self._available is False:
                 return None
             # Worker recycling: restart after N requests to prevent
             # C++ allocator fragmentation over long-running sessions.
@@ -348,6 +354,11 @@ class EmbeddingService:
                     self._available = False
                     self._kill_worker()
                     return None
+                # A successful embed proves the worker is healthy, so clear any
+                # transient/``None`` availability left by a self-heal re-probe
+                # back to a definite ``True``. Without this the flag lingers at
+                # ``None`` and the next ``not``-style check elsewhere re-blocks.
+                self._available = True
                 self._reset_idle_timer()
                 self._request_count += 1
                 return resp["vectors"]

package/src/superlocalmemory/core/engine.py

@@ -276,6 +276,18 @@ class MemoryEngine:
                 )
                 self._llm = None
 
+        # H-03 (3.7.9): surface mode-capability degradation explicitly at
+        # startup. validate_mode_config existed but was never called, so Mode B
+        # silently using rule-based extraction after Ollama vanished (update,
+        # restart, port conflict) went unwarned. Each mode only checks its own
+        # capabilities, so passing the single llm-availability signal is safe.
+        from superlocalmemory.core.modes import validate_mode_config
+        _llm_up = getattr(self, "_llm", None) is not None
+        for _warning in validate_mode_config(
+            self._config.mode, has_ollama=_llm_up, has_cloud_llm=_llm_up,
+        ):
+            logger.warning("Mode config: %s", _warning)
+
         from superlocalmemory.trust.scorer import TrustScorer
         from superlocalmemory.trust.provenance import ProvenanceTracker
         from superlocalmemory.compliance.eu_ai_act import EUAIActChecker
@@ -374,7 +386,9 @@ class MemoryEngine:
             return
 
         base_dir = self._config.base_dir
-        pending = get_pending(base_dir, limit=20)
+        # Only drain items enqueued under THIS engine's profile — a queued
+        # memory must never materialize under a profile it was not written for.
+        pending = get_pending(base_dir, limit=20, profile_id=self.profile_id)
         if not pending:
             return
 
@@ -599,6 +613,7 @@ class MemoryEngine:
         *,
         include_global: bool | None = None,
         include_shared: bool | None = None,
+        window: str | tuple[str, str] | None = None,
     ) -> RecallResponse:
         """Recall relevant facts for a query.
 
@@ -650,6 +665,7 @@ class MemoryEngine:
                 fast=fast,
                 include_global=include_global,
                 include_shared=include_shared,
+                window=window,
             )
         except Exception as exc:
             from superlocalmemory.infra.local_diagnostics import record_operation

package/src/superlocalmemory/core/engine_ingestion.py

@@ -11,9 +11,13 @@ implementation of queryable projection and complete derivation.
 from __future__ import annotations
 
 import hashlib
+import logging
+import os
 import uuid
 from typing import TYPE_CHECKING
 
+logger = logging.getLogger(__name__)
+
 from superlocalmemory.core.ingestion_command import (
     IngestionCommand,
     IngestionOperation,
@@ -30,6 +34,21 @@ if TYPE_CHECKING:
 _PREBUILT_FACT_KEY = "_slm_prebuilt_fact_v1"
 
 
+def _pii_redaction_enabled(engine: "MemoryEngine") -> bool:
+    """C4: opt-in PII redaction on ingest.
+
+    On when the engine config sets ``pii_redaction`` truthy OR the
+    ``SLM_PII_REDACTION`` env var is set (1/on/true/yes). Default OFF — personal
+    use is unchanged; team/company operators opt in.
+    """
+    cfg = getattr(engine, "_config", None)
+    if cfg is not None and getattr(cfg, "pii_redaction", False):
+        return True
+    return os.environ.get("SLM_PII_REDACTION", "").strip().lower() in (
+        "1", "on", "true", "yes",
+    )
+
+
 def content_passes_admission(content: str) -> bool:
     """Return whether raw content is eligible to reach durable ingestion.
 
@@ -140,6 +159,16 @@ def canonical_store(
             error=ValueError("content rejected by local admission policy"),
         )
         return []
+    # C4: opt-in PII redaction. When enabled (config.pii_redaction or
+    # SLM_PII_REDACTION), scrub personal identifiers BEFORE the content is
+    # extracted, embedded, or persisted — nothing sensitive ever reaches disk.
+    if _pii_redaction_enabled(engine):
+        from superlocalmemory.core.pii import redact_pii
+
+        scrubbed, n_pii = redact_pii(content)
+        if n_pii:
+            content = scrubbed
+            logger.info("PII redaction: scrubbed %d identifier(s) on ingest", n_pii)
     try:
         command = build_engine_ingestion_command(engine)
         receipt = command.submit(IngestionRequest(

package/src/superlocalmemory/core/engine_wiring.py

@@ -588,6 +588,19 @@ def init_retrieval(
     except Exception as exc:
         logger.debug("Forgetting filter registration failed: %s", exc)
 
+    # Phase 4 (T1): Register bi-temporal validity filter. Drops superseded /
+    # system-invalidated facts from retrieval so contradicted memories never
+    # resurface. Pure SQL, safe in all modes; no-op until a fact is invalidated.
+    try:
+        from superlocalmemory.retrieval.temporal_validity_filter import (
+            register_temporal_validity_filter,
+        )
+        register_temporal_validity_filter(
+            engine._registry, db, config.temporal_validator,
+        )
+    except Exception as exc:
+        logger.debug("Temporal validity filter registration failed: %s", exc)
+
     return engine
 
 

package/src/superlocalmemory/core/entity_community.py

@@ -0,0 +1,178 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V3 | https://qualixar.com | https://varunpratap.com
+
+"""Entity-community backbone (Wave Q) — the single principled clustering spine.
+
+Best-in-market memory graphs (GraphRAG, Graphiti/Zep) cluster the ENTITY
+graph, not the raw fact/chunk graph. SLM's fact graph is capped-sparse
+(5 edges/entity), so a fact-level clustering fragments. This module builds an
+entity co-occurrence graph (two entities are linked when they appear together
+in a fact, weighted by co-occurrence count) and runs Louvain community
+detection over it — the correct target and, since entities are far fewer than
+facts, a cheaper computation.
+
+The resulting entity communities are the shared backbone for:
+  - Q2 community summaries (one synthesized report per community), and
+  - Q3 progressive abstraction (scenario/persona tiers + drill-down).
+
+Runs in the background (consolidation lane), never on the hot recall path.
+Fail-open and idempotent: a recompute fully replaces a profile's rows.
+
+Part of Qualixar | Author: Varun Pratap Bhardwaj
+License: AGPL-3.0-or-later
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+from collections import Counter, defaultdict
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+
+class EntityCommunityBuilder:
+    """Build + persist entity communities via Louvain over co-occurrence."""
+
+    def __init__(
+        self,
+        db: Any,
+        min_community_size: int = 2,
+        resolution: float = 1.0,
+        seed: int = 42,
+    ) -> None:
+        self._db = db
+        self._min_size = max(2, int(min_community_size))
+        self._resolution = float(resolution)
+        self._seed = int(seed)
+
+    # ------------------------------------------------------------------
+    # Detection
+    # ------------------------------------------------------------------
+
+    def _cooccurrence(self, profile_id: str) -> Counter:
+        """Count entity pairs that co-occur within a fact (per profile)."""
+        rows = self._db.execute(
+            "SELECT canonical_entities_json FROM atomic_facts "
+            "WHERE profile_id = ?",
+            (profile_id,),
+        )
+        weights: Counter = Counter()
+        for row in rows:
+            raw = dict(row).get("canonical_entities_json")
+            if not raw:
+                continue
+            try:
+                parsed = json.loads(raw)
+            except (ValueError, TypeError):
+                continue
+            if not isinstance(parsed, list):
+                continue
+            ents = sorted({str(e).strip() for e in parsed if str(e).strip()})
+            for i in range(len(ents)):
+                for j in range(i + 1, len(ents)):
+                    weights[(ents[i], ents[j])] += 1
+        return weights
+
+    def detect(self, profile_id: str) -> dict[str, int]:
+        """Return {entity_id -> community_id}; communities below min size drop."""
+        weights = self._cooccurrence(profile_id)
+        if not weights:
+            return {}
+
+        import networkx as nx
+
+        g = nx.Graph()
+        for (a, b), w in weights.items():
+            g.add_edge(a, b, weight=w)
+
+        try:
+            from networkx.algorithms.community import louvain_communities
+
+            communities = louvain_communities(
+                g, weight="weight", resolution=self._resolution, seed=self._seed,
+            )
+        except Exception as exc:  # pragma: no cover - fallback path
+            logger.debug(
+                "Louvain unavailable/failed (%s); using connected components",
+                exc,
+            )
+            communities = nx.connected_components(g)
+
+        result: dict[str, int] = {}
+        cid = 0
+        for comm in communities:
+            members = list(comm)
+            if len(members) < self._min_size:
+                continue
+            for node in members:
+                result[node] = cid
+            cid += 1
+        return result
+
+    # ------------------------------------------------------------------
+    # Persistence
+    # ------------------------------------------------------------------
+
+    def compute_and_store(self, profile_id: str) -> dict[str, int]:
+        """Detect communities and replace this profile's stored rows."""
+        mapping = self.detect(profile_id)
+        try:
+            self._db.execute(
+                "DELETE FROM entity_communities WHERE profile_id = ?",
+                (profile_id,),
+            )
+            for entity_id, community_id in mapping.items():
+                self._db.execute(
+                    "INSERT OR REPLACE INTO entity_communities "
+                    "(profile_id, entity_id, community_id, computed_at) "
+                    "VALUES (?, ?, ?, datetime('now'))",
+                    (profile_id, entity_id, community_id),
+                )
+        except Exception as exc:
+            logger.debug("entity_communities persist failed: %s", exc)
+
+        return {
+            "entity_count": len(mapping),
+            "community_count": len(set(mapping.values())),
+        }
+
+    # ------------------------------------------------------------------
+    # Read API
+    # ------------------------------------------------------------------
+
+    def get_communities(self, profile_id: str) -> dict[int, list[str]]:
+        """Return {community_id -> [entity_id, ...]} for a profile."""
+        try:
+            rows = self._db.execute(
+                "SELECT entity_id, community_id FROM entity_communities "
+                "WHERE profile_id = ? ORDER BY community_id",
+                (profile_id,),
+            )
+        except Exception as exc:
+            logger.debug("get_communities failed: %s", exc)
+            return {}
+        out: dict[int, list[str]] = defaultdict(list)
+        for row in rows:
+            d = dict(row)
+            out[int(d["community_id"])].append(str(d["entity_id"]))
+        return dict(out)
+
+    def get_community_for_entity(
+        self, entity_id: str, profile_id: str,
+    ) -> int | None:
+        """Return the community id for one entity, or None."""
+        try:
+            rows = self._db.execute(
+                "SELECT community_id FROM entity_communities "
+                "WHERE profile_id = ? AND entity_id = ?",
+                (profile_id, entity_id),
+            )
+        except Exception as exc:
+            logger.debug("get_community_for_entity failed: %s", exc)
+            return None
+        for row in rows:
+            return int(dict(row)["community_id"])
+        return None