ThothII/.superpowers/sdd/pgvector-task-3-report.md

Task 3 report — optional local pgvector profile

Status

Implemented and verified the local-vector Compose profile.

• vector-db uses pgvector 0.8.5 on PostgreSQL 16, pinned to the official multi-arch manifest digest.
• vector_data is a project-scoped named volume and is not shared with application data.
• database readiness gates the packaged one-shot vector-migrate job; core declares the migration completion dependency while remaining usable in the pre-existing external profile.
• bootstrap, migrator, reader, and writer identities are distinct. Bootstrap and migration credentials are supplied as Compose secrets; the application receives only reader/writer credentials.
• deploy/workspaces/local-vector.yaml selects pgvector_direct with separate reader and writer connections.
• the base loopback port binding, AUTH_MODE=none, and THOTH_PUBLIC_EXPOSURE=false defaults are unchanged.

Red/green evidence

The initial Compose contract did not list vector-db, as required by the brief. The first real smoke then failed migration 002 because bootstrap installed the vector extension in public. The bootstrap was corrected to create the vectors schema under the migration owner and install the extension there. A clean-volume rerun passed.

Verification

• ./scripts/local-vector-smoke.sh: PASS
  • isolated generated Compose project and credentials
  • clean migration plus idempotent status rerun
  • reader/writer privilege health
  • one-record upsert and similarity search
  • restart of both core and vector-db
  • persisted search result after restart
  • project-only volume cleanup
• ./scripts/test-container-deployment.sh: PASS
• ./scripts/test-backend-url-policy.sh: PASS
• docker compose --profile local-vector config --quiet: PASS
• harness: 477 passed, 5 deselected
• backend: 84 passed; TypeScript typecheck PASS
• frontend: 226 passed; TypeScript typecheck PASS
• git diff --check: PASS

Self-review / concerns

• Compose cannot make a dependency required only under one profile. The core dependency uses required: false so the established external profile does not activate local infrastructure; under local-vector, compose up --wait still fails if vector-migrate exits nonzero, and the smoke verifies that successful migration precedes the healthy stack.
• Reader/writer passwords are injected into core environment variables because Compose service attributes cannot be conditional by profile. Bootstrap and migrator credentials remain file-backed secrets and are never exposed to core.
• The smoke intentionally refuses the operator project name thothii and removes only its unique project namespace and volumes.