Repository navigation
feat: host EdgeQuake on Databricks Apps with Lakebase and MLflow - #508
Draft
raphaelmansuy wants to merge 11 commits into
Draft
raphaelmansuy wants to merge 11 commits into
raphaelmansuy wants to merge 11 commits into
Conversation
Record live probe results for Postgres 18.6, pgvector 0.8.6, and AI Gateway chat and embeddings, plus a code-grounded plan that reuses the SPEC-164 plain graph. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
Mint a Lakebase password for each new pool connection, speak the MLflow chat and embeddings API, and add an App launcher. Docker keeps the static DATABASE_URL path. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
Apps inject DATABRICKS_HOST without a scheme and the app role cannot ALTER a schema an admin already migrated. The launcher normalizes the host, keeps the boot log when the binary exits, and starts the server before migrate. Production CORS is the app origin. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
cursor
Bot
changed the title
The API has no route for GET /, so a signed-in browser showed a 404. The launcher keeps the public port and returns the home page there, and forwards every other path to the API on an internal port. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
The Databricks launcher starts the Next.js app beside the API and forwards browser routes to it. Sign-in returns to the app instead of the API reference. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
Databricks Apps set DATABRICKS_HOST, so the settings picker can offer Llama 4 Maverick and GTE large when that host is present. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
The public proxy forwarded the live socket as a normal HTTP request and dropped the Upgrade header. The API answered 400, the browser reported the connection lost, and the tenant request on that connection failed. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
/health is public, so the header shows API v0.36.0, but /api/v1/tenants returns 401 unless the EdgeQuake bearer arrives. The Apps proxy replaces Authorization, so the launcher stores that bearer in a cookie and puts it back on the internal request. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
/health is public, so the header shows API v0.36.0, while /api/v1/tenants returns 401 when the EdgeQuake bearer is missing. The page now copies that bearer into X-EdgeQuake-Authorization and the launcher restores it on the internal request. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
FORCE RLS rejects autocommit inserts because current_tenant_id() dies when the statement ends. Superuser sessions keep the existing statements. A Lakebase service principal sets the tenant inside the same transaction for documents, chunks, tasks, and the entity sink. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
Lakebase checks tenant_access_guard when the row is written. A tenant id set by an earlier statement is not visible to that check, so the document insert still failed. The insert now calls set_config itself. Co-authored-by: Raphael MANSUY <raphael.mansuy@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Lakebase checks
tenant_access_guardwhen the document row is written.current_tenant_id()has to be set in that same statement. Setting it on an earlier statement left the check empty, so dedup reserve still failed withnew row violates row-level security policy "tenant_access_guard".Document, chunk, task, shell, and entity inserts now call
set_configin the insert statement. Rows with no tenant keep the previous statement. Superuser sessions still bypass the policy.Deployed snapshot
01f1cd36fcb61b02b6b803f8547e42ed. Highest glibc symbol is 2.34. Boot report: ldd clean,ui-ready 200,exit=None, app RUNNING.Type of change
Checklist
Additional context
On Lakebase, an insert as
edgequake_tenant_accesssucceeded whenset_configran inside the insert, after the tenant id had been cleared.cargo test -p edgequake-tasks --lib183 passed.cargo test -p edgequake-storage --lib294 passed.