feat(deploy): add optional local pgvector profile

2026-07-12 01:42:37 +02:00
parent 3588a7749b
commit 0ca9783f61
6 changed files with 333 additions and 2 deletions
@@ -0,0 +1,55 @@
+# Task 3 report — optional local pgvector profile
+
+## Status
+
+Implemented and verified the `local-vector` Compose profile.
+
+- `vector-db` uses pgvector 0.8.5 on PostgreSQL 16, pinned to the official multi-arch
+  manifest digest.
+- `vector_data` is a project-scoped named volume and is not shared with application data.
+- database readiness gates the packaged one-shot `vector-migrate` job; core declares the
+  migration completion dependency while remaining usable in the pre-existing external profile.
+- bootstrap, migrator, reader, and writer identities are distinct. Bootstrap and migration
+  credentials are supplied as Compose secrets; the application receives only reader/writer
+  credentials.
+- `deploy/workspaces/local-vector.yaml` selects `pgvector_direct` with separate reader and
+  writer connections.
+- the base loopback port binding, `AUTH_MODE=none`, and `THOTH_PUBLIC_EXPOSURE=false` defaults
+  are unchanged.
+
+## Red/green evidence
+
+The initial Compose contract did not list `vector-db`, as required by the brief. The first real
+smoke then failed migration 002 because bootstrap installed the vector extension in `public`.
+The bootstrap was corrected to create the `vectors` schema under the migration owner and install
+the extension there. A clean-volume rerun passed.
+
+## Verification
+
+- `./scripts/local-vector-smoke.sh`: PASS
+  - isolated generated Compose project and credentials
+  - clean migration plus idempotent status rerun
+  - reader/writer privilege health
+  - one-record upsert and similarity search
+  - restart of both `core` and `vector-db`
+  - persisted search result after restart
+  - project-only volume cleanup
+- `./scripts/test-container-deployment.sh`: PASS
+- `./scripts/test-backend-url-policy.sh`: PASS
+- `docker compose --profile local-vector config --quiet`: PASS
+- harness: 477 passed, 5 deselected
+- backend: 84 passed; TypeScript typecheck PASS
+- frontend: 226 passed; TypeScript typecheck PASS
+- `git diff --check`: PASS
+
+## Self-review / concerns
+
+- Compose cannot make a dependency required only under one profile. The core dependency uses
+  `required: false` so the established `external` profile does not activate local infrastructure;
+  under `local-vector`, `compose up --wait` still fails if `vector-migrate` exits nonzero, and the
+  smoke verifies that successful migration precedes the healthy stack.
+- Reader/writer passwords are injected into core environment variables because Compose service
+  attributes cannot be conditional by profile. Bootstrap and migrator credentials remain
+  file-backed secrets and are never exposed to core.
+- The smoke intentionally refuses the operator project name `thothii` and removes only its unique
+  project namespace and volumes.