ENG-2336 Publish cross-space relations from Obsidian

[maparent]

https://entire.io/gh/DiscourseGraphs/discourse-graph/trails/59

Reviewer brief

• Result: Obsidian publishes a relation to a group when both ends are published to it, including imported ends. An imported end's groups come from getPublishedGroupIdsByRid (ENG-2335). A local end's groups still come from its publishedToGroups frontmatter.
• Stacked on ENG-2335 Add a shared check for whether an imported node is published to a group #1512 (ENG-2335). Review the diff against that branch.
• Review focus (all in apps/obsidian/src/utils/publishNode.ts):
  • getPublishedGroupsByNode, used by publishNewRelation, publishNodeRelations and ensurePublishedRelationsAccuracy.
  • getGroupIdsWithSpaceAccess writes the group's SpaceAccess row before any relation grant. publishNodeToGroup now calls publishNodeRelations after its own SpaceAccess write. Without that row, group members can't see the space, so they can't import the relation.
  • Failure handling in ensurePublishedRelationsAccuracy. If the imported-node lookup throws, the function returns before deleting any grant, so local-only relations also wait for the next full sync. If the SpaceAccess call throws, the function still saves the grants it deleted.
  • publishNodeRelations now skips relations with importedFromRid. The old frontmatter check excluded them only by side effect.
• Risk or follow-up:
  • Deferred: route the inline SpaceAccess upsert in publishNodeToGroup through ensurePartialSpaceAccess.

Verification

Unit tests and loom.
Criterion 4 of "Done When" has to come after one of the import PRs ( ENG-2340 or ENG-2339 )

Loom video

https://www.loom.com/share/e56c75cdbb3f436a9365993c7d39f284

Scope check

• Ran $scope-check against ENG-2336 and the final diff.
• Scope beyond Done When:
  • publishNodeRelations, which runs when a local node with relations is published, now gets an imported end's groups from the ENG-2335 check. It also skips relations with importedFromRid.
  • Creating or syncing a relation now writes the group's SpaceAccess "partial" row before the grant. The relation isn't granted if that write fails. As a result, a vault with no local node published to G becomes visible to G (its Space row) as soon as it publishes a relation between two imported nodes. (This is only scope expansion with a narrow reading of Done when; see linear note)
  • publishNodeToGroup now publishes the node's relations after its SpaceAccess write.
• Required now:
  • Without the publishNodeRelations change, relations to imported nodes wait for the next full sync. The skip is needed because the new lookup can now find groups for relations from another space.
  • The relation grant required by criterion 2 can't be imported without the SpaceAccess row, and ENG-2339 depends on importing it.
• Anyone affected or consulted: Not documented. The note comes from the author only.
• Decision: ENG-2336 Solution notes comment (updated 2026-10-03)

Standards check

• Ran $dg-pr-adherence-check against the final diff and PR metadata.

Local delegated full review

• Ran a comprehensive review of the entire final diff in a subagent with a fresh context. Use $dg-delegated-full-review when no other full-review workflow is available.

https://linear.app/discourse-graphs/issue/ENG-2336/publish-cross-space-relations-from-obsidian

---

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
discourse-graph	Skipped		Oct 4, 2026 3:30pm UTC

[supabase]

This pull request has been ignored for the connected project zytfjzqyijgagqxrzbmz because there are no changes detected in packages/database/supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[linear-code]

ENG-2336

[devin-ai-integration]

Devin Review found 1 potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

🟡 Local relations stop reconciling on remote failure

When an imported-node group lookup fails, ensurePublishedRelationsAccuracy skips local-only relations too. Their missing grants remain missing, and stale grants remain until another successful sync.

Learn more

A full sync reconciles group grants for all locally owned relations. Local endpoints get their groups directly from frontmatter, but imported endpoints require a database lookup. A failure in that lookup currently exits before any local-only relation is reconciled. That also changes the previous behavior, which did not need that lookup for local-only relations.

Example: A local-to-local relation is unpublished from group g1, while an unrelated imported node belongs to another relation. If the imported lookup fails during sync, the local relation's stale g1 grant remains instead of being removed.

Recommended fix: Separate relations with imported endpoints from local-only relations. Reconcile local-only relations from frontmatter even when imported-node lookup fails, while leaving grants for imported-endpoint relations untouched until their groups can be resolved.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[maparent]

Intentional, and documented in the comment on this catch. The lookup only queries when the space has relations with imported ends. On a full sync it runs after upsert_concepts and the synced-relations read, so a database outage fails the sync before this point. That leaves a failure of the lookup alone, which the next full sync recovers from. Splitting reconciliation into local-only and imported-end sets would add a second path through this function to cover that window, so we chose not to.