[raphaelmansuy]

Description

v0.40.11 is tagged (v0.40.11 → 926d357b6). Schema stays 231. Upgrade notes: docs/operations/upgrade-to-0.40.11.md.

A query on a Normal or image workspace still failed with GOOGLE_CLOUD_PROJECT is not set after the project was saved on the Vertex card. The query built gemini-embedding-2 from the process environment and never opened the connection. Query, chat, and image ingest now use the project saved on that connection. A stored service account is used when one is saved. The image publish is Release — Docker (GHCR). Deploy GCP rolls the demo after that workflow succeeds, because the tag branch is v0.40.11.

The organization model ceiling and the workspace model list, arranged by job, ship in this same image.

v0.40.10 is tagged (v0.40.10 → 3812ed443). Schema stays 231. Upgrade notes: docs/operations/upgrade-to-0.40.10.md.

The v0.40.9 image publish (Release — Docker) was cancelled when quality-gates hit its 90 minute limit during a cold compile. The tests had passed. v0.40.10 raises that limit to 180 minutes. The new publish is Release — Docker (GHCR). Deploy GCP rolls the demo after that workflow succeeds.

Edit a provider

Deployment › Providers had Refresh and Remove, and no way to change a provider. Each card now has Edit. Update saves the name, base URL, a replacement key, and, for Vertex, the Google Cloud project. Leave the key blank to keep the key the server already has. The demo picks this up when the v0.40.10 image publish finishes and Deploy GCP rolls it.

v0.40.8 is tagged (v0.40.8 → ba38afcb2). Schema moves 227 → 231. Run edgequake migrate before the new API replicas. Upgrade notes: docs/operations/upgrade-to-0.40.8.md.

The image publish for v0.40.8 is Release — Docker (GHCR). v0.40.9 was cancelled at the 90 minute gate (run). v0.40.10 is Release — Docker (GHCR).

Model ceiling, by job

The organization ceiling was a grid of empty boxes. An empty box meant the job was open, so a long list of chat models looked like nothing was allowed, and a dash hid the difference between "cannot do this job" and "not chosen."

Each model now lists only the jobs it can do, grouped by provider. Choose a job to see that list alone. An open job can use any registered model that fits it. The first model you allow closes that job to the models you tick. Workspaces use the same shape: a tick keeps the model, unticking it turns it off for that workspace. A name that follows whichever model is loaded says so. The SPEC-175 editor tests still pass, including the ceiling save and the workspace narrowing save.

A Vertex connection now saves its Google Cloud project (231)

The query page failed with GOOGLE_CLOUD_PROJECT is not set even when Vertex was saved, healthy, and offered. The embedding client was built from the process environment and never read the connection. A server-identity row stored nothing, so it was invisible to the fleet lookup.

Migration 231 adds provider_connections.google_project. The Connections form asks for the project, requires it for a server identity or an API key, and takes it from a service-account file when the field is left blank. Queries, chat, and gemini-embedding-2 use that saved project. GOOGLE_CLOUD_PROJECT is not read on that path. The deployment card shows Project {id}.

Row security (228–230)

An EXPLAIN-driven audit of the PostgreSQL query and index surface, run against a database built from the real migration chain and seeded to production-like scale: 3 tenants, 20 workspaces, 4k documents, 120k chunks, 2.2M BM25 postings, 120k halfvec(1536) embeddings with HNSW.

Three performance defects found, all fixed, measured, and guarded. A later commit realigns six pre-existing stale contract tests (no production source changed).

1. The clearance policy called a per-row function for a per-statement value (228)

Migration 220's restrictive clearance policy buried two row-independent terms inside the per-row clearance_covers(), so the planner evaluated them once per candidate row and no scalar subquery could be hoisted out.

Split at the point where row-independence ends: clearance_bypass() (row-independent), clearance_rank_covers() (per row), and clearance_covers() kept as bypass OR rank_covers so the three out-of-policy callers in graph/plain need no change. Policies call (SELECT clearance_bypass()), which the planner turns into an InitPlan — the technique migration 208 established.

2. The scope indexes did not cover the clearance columns (229)

The (tenant_id, workspace_id) indexes covered the scan but not the policy, so every candidate row was fetched from the heap only to be discarded — 18,000 heap blocks for one count. INCLUDE-ing the clearance columns makes it index-only. Each index replaces the existing one, so chunks stays at 16 indexes. Two byte-identical duplicate index pairs dropped.

Query (RLS-demoted, 36k chunks in one workspace)	Before	After
chunk count	291–407 ms	5–9 ms
chunk FTS page	263–270 ms	99–181 ms
document page	7.2–7.9 ms	0.8–1.8 ms
document count	6.6–6.7 ms	0.32–0.37 ms

3. Six policies still called session helpers bare (230)

Migration 208 wrapped session helpers in policy expressions and then documented an invariant: "New policies must use the wrapped form … e2e_rls_initplan_policies (edgequake-storage) fails if any are left bare." That guard test was never written, and five later migrations (215, 216, 219, 222, 225) reintroduced the bare form. Six policies were still re-invoking the helpers once per emitted row.

The plans show it directly: the index-only scan carried Filter: $0 over 4,031 rows on workspace_term_stats and 372,000 on chunk_terms. Wrapped, neither scan carries a filter and each helper is one InitPlan.

Query (RLS-demoted, median of 9 alternating runs)	Before	After
full BM25 statement	24.6 ms	12.4 ms (9/9 runs improved)

The composite statement gains what an isolated count(*) does not: a count reads only the index, while BM25 joins both tables and re-scans chunk_terms three times, so removing the per-row evaluation is where the time goes.

This PR also adds the guard test 208 promised, so the invariant cannot rot again.

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective and that my feature works
• New and existing tests pass locally with my changes

Additional context

Saved project, tested

• Postgres: a_saved_project_embeds_without_google_cloud_project creates a fleet Vertex row with only google_project = mobioos-506015, loads it, and builds the gemini-embedding-2 client while GOOGLE_CLOUD_PROJECT is unset. The same test now builds the query embedder for a vertexai / gemini-embedding-2 workspace and checks the fleet client calls project mobioos-506015.
• Postgres: the existing fleet create stores mobioos-506015 taken from the service-account file, and the secret update SQL still runs with the two new binds.
• UI: the Connections form keeps Save disabled until a project is typed, and the POST body contains google_project. The saved row and the deployment card render Project {id}.
• OpenAPI snapshot on this branch is 0.40.11 and includes google_project and base_url. The Edit form test saves the project with PUT and creates a connection for an environment provider with POST.
• cargo clippy -p edgequake-api --features postgres --lib -- -D warnings is clean. Epoch coverage passes with the v0.40.10 tag (max=231, hash ba0c9db9d18d39c1, same migration set as v0.40.8). v0.40.11 adds no migration, so it serves that same set.

No regression, proven per change

• Equivalence, exhaustively. 19,440 comparisons of the split clearance predicate against the verbatim migration-220 definition — 0 mismatches.
• Suites from the audit. edgequake-storage --tests 180/180 · contract_spec150_train_head through 231 · e2e_tenant_rls · e2e_spec228_clearance_bypass · e2e_rls_initplan_policies.
• Write cost unchanged. 2,000 chunk inserts measured 59–67 ms before and 59–66 ms after.

SPEC-001 Acc

Not re-scored. Mix retrieval ranking is unchanged. The latest valid pack remains medical-mid-20261024T031725Z (valid: true): EdgeQuake 0.8084, LightRAG 0.7681, delta +0.0403, 95% CI [-0.0241, +0.1036] (n_paired 72). The interval includes 0, so this is a statistical tie. EdgeQuake does not claim a win.

Checks that stay red

Security Audit (RUSTSEC-2026-0429, zip) and the E2E UI gate (Playwright has no Chromium build for ubuntu 26.04) are already red on edgequake-main. This release does not ignore the advisory. release-docker scans images with Trivy, not cargo audit.