BE-783: Wire the atlas into the graph CLI, API proxy, and embedding workflows - #9306
Open
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
github-actions
Bot
added
area/deps
![semgrep-code-hashintel[bot]](https://avatars.githubusercontent.com/u/22116112?s=60&v=4){kind=small}
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## bm/be-782-atlas-fit-2d-semantic-maps-over-graph-entities-and-serve #9306 +/- ##
======================================================================================================
+ Coverage 60.74% 60.77% +0.02%
======================================================================================================
Files 1440 1443 +3
Lines 143477 143624 +147
Branches 6662 6665 +3
======================================================================================================
+ Hits 87156 87281 +125
- Misses 55229 55252 +23
+ Partials 1092 1091 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 24, 2026 15:21
7bee133 to
6689890
Compare
indietyp
changed the title
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 25, 2026 10:57
41dc1fa to
6a19553
Compare
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 25, 2026 11:14
6a19553 to
a0621e7
Compare
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 26, 2026 12:24
a0621e7 to
15526e4
Compare
TimDiekmann
requested changes
Aug 26, 2026
Comment on lines
+677
to
+680
| # No fallback: the atlas refuses to serve without a configured secret. | ||
| # The development stack sets one in .env.development; production supplies | ||
| # its own 64-hex-character value (openssl rand -hex 32). | ||
| HASH_GRAPH_ATLAS_SECRET: "${HASH_GRAPH_ATLAS_SECRET:?set HASH_GRAPH_ATLAS_SECRET to 64 hex characters, e.g. openssl rand -hex 32}" |
Member
There was a problem hiding this comment.
Can we follow the same pattern we have everywhere else?
| FILE_UPLOAD_PROVIDER="AWS_S3" | ||
|
|
||
| # Development only dev secret for atlas | ||
| HASH_GRAPH_ATLAS_SECRET=de70de70de70de70de70de70de70de70de70de70de70de70de70de70de70de70 |
Member
There was a problem hiding this comment.
We can just use a simple feature as we do with every other service in .env. The solution is not great and I'm working on a configuration crate to solve this, but until then, it keeps things simple. The .env file is not used in production. If we desperately want these, we can generate one and put them in .env.local
Member
Author
There was a problem hiding this comment.
So you mean we should put it in .env? I just wanted to make sure that someone doesn't accidentally deploy it with a default secret; hence this and the other changes. If you want to, I can also put it into .env no problem.
Comment on lines
+13
to
+16
| # The dev values compose interpolation needs (e.g. HASH_GRAPH_ATLAS_SECRET, which compose | ||
| # refuses to run without). The yarn `compose` script passes these files explicitly, and the | ||
| # raw `docker compose` invocations below read them through this variable instead. | ||
| COMPOSE_ENV_FILES: ${{ github.workspace }}/.env,${{ github.workspace }}/.env.development |
Member
There was a problem hiding this comment.
With the two changes above, we don't need this:
Suggested change
| # The dev values compose interpolation needs (e.g. HASH_GRAPH_ATLAS_SECRET, which compose | |
| # refuses to run without). The yarn `compose` script passes these files explicitly, and the | |
| # raw `docker compose` invocations below read them through this variable instead. | |
| COMPOSE_ENV_FILES: ${{ github.workspace }}/.env,${{ github.workspace }}/.env.development |
I also don't see where it's used in the first place.
Comment on lines
+15
to
+18
| # The dev values compose interpolation needs (e.g. HASH_GRAPH_ATLAS_SECRET, which compose | ||
| # refuses to run without). The yarn `compose` script passes these files explicitly, and the | ||
| # raw `docker compose` invocations below read them through this variable instead. | ||
| COMPOSE_ENV_FILES: ${{ github.workspace }}/.env,${{ github.workspace }}/.env.development |
Member
There was a problem hiding this comment.
With the two changes above, we don't need this:
Suggested change
| # The dev values compose interpolation needs (e.g. HASH_GRAPH_ATLAS_SECRET, which compose | |
| # refuses to run without). The yarn `compose` script passes these files explicitly, and the | |
| # raw `docker compose` invocations below read them through this variable instead. | |
| COMPOSE_ENV_FILES: ${{ github.workspace }}/.env,${{ github.workspace }}/.env.development |
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 27, 2026 09:14
15526e4 to
6a614d9
Compare
indietyp
force-pushed
the
bm/be-783-wire-the-atlas-into-the-graph-cli-api-proxy-and-embedding
branch
from
August 27, 2026 10:40
6a614d9 to
2de4919
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🌟 What is the purpose of this PR?
Wires the atlas into the running system.
hash-graphgains anatlassubcommand (fit,serve) andhash-apigains an authenticated proxy in front of the atlas server plus a cluster-entities primitive. The compose stack gains the atlas service, and the embedding workflow keeps fitted maps fed with fresh embeddings.Secret handling refuses before it runs: the compose service interpolates
HASH_GRAPH_ATLAS_SECRETwith:?, so a compose without the secret refuses to start rather than starting open. The service is profile-hidden, and default compose invocations are unchanged.The release profile moves to
lto = "thin". Atfat, the release image build was killed on the 16 GB arm runner (signal 9), and thin fits in its memory.Review focus: the proxy as the auth boundary. Every path to the atlas service passes the proxy's authentication, and the secret stays out of logs and error bodies. Both are worth verifying.
🔍 What does this change?
apps/hash-graph: theatlassubcommand (subcommand/atlas.rs), withcreate_temporal_clientwidened topub(crate)inserver.rs.apps/hash-api:atlas-proxy.tsand its tests,cluster-entities.ts, router registration inindex.ts.infra/compose/compose.yml: the atlas service, profile-hidden, with the:?secret refusal, Postgres env, and a generations volume..envand.env.development: atlas host and port, the dev secret..github/workflows/{bench,test}.yml:COMPOSE_ENV_FILES, so CI's compose reads the same env files the yarn scripts feed it.libs/@local/graph/embeddings: a memory-footprint example.Cargo.toml:lto = "thin".yarn.lockregenerated.Pre-Merge Checklist 🚀
🚢 Has this modified a publishable library?
This PR:
📜 Does this require a change to the docs?
The changes in this PR:
🕸️ Does this require a change to the Turbo Graph?
The changes in this PR:
turbo.json's have been updated to reflect this🛡 What tests cover this?
atlas-proxy.test.ts: 11 tests (build@local/hash-backend-utilsfirst in a fresh tree, the package resolves throughdist/).hash-apitype-checks clean (lint:tsc).docker compose configrefuses without the secret and interpolates it exactly once with it.hash-graph atlas --helpandatlas fit --helpparse.cargo check, clippy at zero warnings across targets and features,fmtclean,sync:turborepozero drift.❓ How to test this?