Repository navigation
Add secure PostgreSQL GraphRAG projection - #22
Conversation
|
Warning Review limit reached
Next review available in: 20 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (9)
📝 WalkthroughWalkthroughAdds a PostgreSQL 18 GraphRAG integration with pgvector and Apache AGE, including relational schema, secure projection storage, vector search, topology traversal, Spring Boot configuration, local Compose wiring, and Testcontainers coverage. ChangesPostgreSQL GraphRAG integration
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant GraphRAGWorker
participant PostgresGraphProjectionStore
participant PostgreSQL
participant ApacheAgeGraphTopologyProjection
GraphRAGWorker->>PostgresGraphProjectionStore: replaceRevision contributions
PostgresGraphProjectionStore->>PostgreSQL: lock revision and write projection
PostgresGraphProjectionStore->>ApacheAgeGraphTopologyProjection: replaceRevision topology
ApacheAgeGraphTopologyProjection->>PostgreSQL: update AGE graph
GraphRAGWorker->>PostgresGraphProjectionStore: search or expand authorized graph
PostgresGraphProjectionStore->>PostgreSQL: filter and rank visible data
PostgreSQL-->>GraphRAGWorker: ranked results and candidate IDs
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ARCHITECTURE.md`:
- Around line 174-175: Update the vector-index documentation in ARCHITECTURE.md
to state that VChordRQ requires the separately installed vchord extension and is
unavailable in the pinned local image built by the postgres-rag Dockerfile.
Document the expected behavior when VChordRQ is configured but the extension is
absent, while preserving the descriptions of the other index types.
In `@integrations/graph-rag-postgres/build.gradle.kts`:
- Around line 7-9: Align the postgres integration dependency metadata with
PostgresGraphRagAutoConfiguration’s reference to JdbcTemplateAutoConfiguration
by adding the spring-boot-jdbc dependency in build.gradle.kts. Preserve the
existing spring-jdbc, spring-boot-autoconfigure, and spring-boot-sql
dependencies unless they are no longer required.
In
`@integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.java`:
- Around line 52-88: Update ensureGraph, used by replaceRevision, to handle
concurrent graph creation safely: when graphExists reports absent, attempt
create_graph and treat Apache AGE’s duplicate-graph error as successful
creation, while propagating other failures. Preserve existing behavior for
already-present graphs and return the graph name after either path completes.
In
`@integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.java`:
- Around line 185-186: Remove the synchronous ensureConfiguredIndexes call from
the PostgresGraphProjectionStore constructor and provision the configured
indexes through an external migration or startup mechanism that runs outside
bean construction. Ensure provisioning is idempotent and uses non-blocking
concurrent index creation where supported, while preserving normal store
initialization and request readiness.
- Around line 732-792: The recursive walk in expandEntityIdsRelationally
currently bounds only per-path visits, allowing duplicate expansion through
different paths before the outer LIMIT. Add a global emitted/expanded-entity
guard to the recursive state, enforce the requested limit and depth while
generating recursive rows, and stop expanding IDs once the global bound is
reached; retain visibility and cycle checks while removing reliance on the outer
DISTINCT/ORDER BY/LIMIT to control traversal work.
In
`@integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.java`:
- Around line 97-102: Thread the selected vector index strategy from
PostgresGraphVectorIndexManager into the query builders, including
PostgresGraphProjectionStore, so HNSW_HALFVEC uses matching
content_vector::halfvec(dimension) <=> query::halfvec(dimension) expressions;
preserve ::vector expressions for all other strategies and update every affected
query path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 16e328b5-0dd6-40f3-acf3-e99d6cb5b3da
⛔ Files ignored due to path filters (6)
docs/decisions/0011-postgresql-multimodel-graph-projection.mdis excluded by!docs/**docs/increments/completed/2026-07-23-graph-rag-postgres/design.mdis excluded by!docs/**docs/increments/completed/2026-07-23-graph-rag-postgres/plan.mdis excluded by!docs/**docs/roadmap.mdis excluded by!docs/**docs/specs/domains/secure-graph-rag.mdis excluded by!docs/**docs/tests/domains/secure-graph-rag.mdis excluded by!docs/**
📒 Files selected for processing (26)
.github/workflows/ci.ymlARCHITECTURE.mdcomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/model/ContributionEmbedding.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphEmbeddingIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionEmbeddings.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphTopologyCandidateIndex.javacompose.yamlcore/src/main/resources/db/migration/V21__secure_graph_projection.sqlinfrastructure/postgres-rag/01-create-openfga-database.shinfrastructure/postgres-rag/Dockerfileintegrations/graph-rag-postgres/build.gradle.ktsintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeMode.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/BoundedBatcher.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagAutoConfiguration.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagProperties.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptions.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresVectorIndexStrategy.javaintegrations/graph-rag-postgres/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjectionIntegrationTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/BoundedBatcherTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStoreIntegrationTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptionsTests.javasettings.gradle.kts
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (6)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Before changing unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult Context7/current official documentation and the projectorgmemory-*verification skills.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Current behavior belongs in architecture/specs only after it exists in code; intent belongs in vision, roadmap, or an active increment, and repository state must not be duplicated across documents.
Files:
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeMode.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/BoundedBatcher.javasettings.gradle.ktscomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphTopologyCandidateIndex.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresVectorIndexStrategy.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionEmbeddings.javaintegrations/graph-rag-postgres/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsintegrations/graph-rag-postgres/build.gradle.ktscomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphEmbeddingIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/model/ContributionEmbedding.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjectionIntegrationTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/BoundedBatcherTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptions.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.javainfrastructure/postgres-rag/Dockerfileintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptionsTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagAutoConfiguration.javainfrastructure/postgres-rag/01-create-openfga-database.shcompose.yamlintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagProperties.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStoreIntegrationTests.javaARCHITECTURE.mdcore/src/main/resources/db/migration/V21__secure_graph_projection.sqlintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.java
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Pair JPA schema changes with a Flyway migration.
Files:
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeMode.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/BoundedBatcher.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphTopologyCandidateIndex.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresVectorIndexStrategy.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionEmbeddings.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphEmbeddingIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/model/ContributionEmbedding.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjectionIntegrationTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/BoundedBatcherTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptions.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptionsTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagAutoConfiguration.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagProperties.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStoreIntegrationTests.javacore/src/main/resources/db/migration/V21__secure_graph_projection.sqlintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.java
**/*.java
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a Java-backend gate only.
Files:
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeMode.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/BoundedBatcher.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphTopologyCandidateIndex.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresVectorIndexStrategy.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionEmbeddings.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphEmbeddingIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/model/ContributionEmbedding.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjectionIntegrationTests.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/BoundedBatcherTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptions.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptionsTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagAutoConfiguration.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagProperties.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.javaintegrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStoreIntegrationTests.javaintegrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.java
.github/**/*.{yml,yaml}
⚙️ CodeRabbit configuration file
.github/**/*.{yml,yaml}: Require least-privilege permissions, immutable action SHAs, bounded job
timeouts, concurrency cancellation, frozen lockfiles, and no secrets in
pull-request workflows. Keep Dependabot comments beside pinned action
SHAs so action updates remain discoverable.
Files:
.github/workflows/ci.yml
**/*.{yml,yaml,properties}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validatein application configuration.
Files:
compose.yaml
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: Flyway migrations are immutable after release. Check tenant isolation,
foreign keys, uniqueness, indexes, append-only evidence semantics, safe
defaults, and compatibility with PostgreSQL 18 plus pgvector.
Files:
core/src/main/resources/db/migration/V21__secure_graph_projection.sql
🪛 Hadolint (2.14.0)
infrastructure/postgres-rag/Dockerfile
[warning] 10-10: Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>
(DL3008)
🪛 OpenGrep (1.25.0)
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.java
[ERROR] 119-124: SQL query built via string concatenation passed to Statement.execute*(). Use PreparedStatement with parameterized queries instead.
(coderabbit.sql-injection.java-statement-concat)
[ERROR] 142-143: SQL query built via string concatenation passed to Statement.execute*(). Use PreparedStatement with parameterized queries instead.
(coderabbit.sql-injection.java-statement-concat)
🪛 SQLFluff (4.2.2)
core/src/main/resources/db/migration/V21__secure_graph_projection.sql
[error] 365-366: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 367-368: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 369-370: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 371-372: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 373-378: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 379-384: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 385-388: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 389-392: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 393-400: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 401-408: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 409-410: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
[error] 411-412: CREATE INDEX should use CONCURRENTLY to avoid locking the table during the build.
(PG01)
🪛 Squawk (2.59.0)
core/src/main/resources/db/migration/V21__secure_graph_projection.sql
[warning] 21-22: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 21-22: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 25-26: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 25-26: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 29-30: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 29-30: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 33-40: By default new constraints require a table scan and block writes to the table while that scan occurs. Use NOT VALID with a later VALIDATE CONSTRAINT call.
(constraint-missing-not-valid)
[warning] 33-40: Adding a UNIQUE constraint requires an ACCESS EXCLUSIVE lock which blocks reads and writes to the table while the index is built. Create an index CONCURRENTLY and create the constraint using the index.
(disallowed-unique-constraint)
[warning] 45-45: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 46-46: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 66-66: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 67-67: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 123-123: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 124-124: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 125-125: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 199-199: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 202-202: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 203-203: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 204-204: Changing the size of a varchar field requires an ACCESS EXCLUSIVE lock, that will prevent all reads and writes to the table. Use a TEXT field with a CHECK constraint.
(prefer-text-field)
[warning] 282-282: Using 32-bit integer fields can result in hitting the max int limit. Use 64-bit integer values instead to prevent hitting this limit.
(prefer-bigint-over-int)
[warning] 327-327: Using 32-bit integer fields can result in hitting the max int limit. Use 64-bit integer values instead to prevent hitting this limit.
(prefer-bigint-over-int)
🪛 Trivy (0.72.0)
infrastructure/postgres-rag/Dockerfile
[error] 1-1: Image user should not be 'root'
Specify at least 1 USER command in Dockerfile with non-root user as argument
Rule: DS-0002
(IaC/Dockerfile)
[info] 1-1: No HEALTHCHECK defined
Add HEALTHCHECK instruction in your Dockerfile
Rule: DS-0026
(IaC/Dockerfile)
🔇 Additional comments (32)
ARCHITECTURE.md (5)
15-15: LGTM!
25-34: LGTM!
80-80: LGTM!
165-173: LGTM!
176-188: LGTM!components/graph-rag-core/src/main/java/com/orgmemory/graphrag/model/ContributionEmbedding.java (1)
1-19: LGTM!components/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionEmbeddings.java (1)
1-53: LGTM!components/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphTopologyCandidateIndex.java (1)
1-23: LGTM!core/src/main/resources/db/migration/V21__secure_graph_projection.sql (2)
42-413: LGTM! New tables, constraints, and indexes are well-scoped for tenant isolation and provenance/authorization linkage.
20-40: 🩺 Stability & AvailabilityVerify production data impact before adding these UNIQUE constraints.
The four
ADD CONSTRAINT ... UNIQUEstatements run on existing tables, and PostgreSQL acquires anACCESS EXCLUSIVElock while scanning the table to build the supporting index. If these tables carry production rows, this migration can block reads/writes.NOT VALIDdoes not apply to UNIQUE constraints; instead build each unique indexCONCURRENTLYoutside Flyway’s transaction, then attach it withUNIQUE USING INDEX.infrastructure/postgres-rag/Dockerfile (1)
1-39: LGTM!integrations/graph-rag-postgres/build.gradle.kts (1)
1-20: LGTM on remaining dependency declarations (test scope, Flyway/Testcontainers wiring).integrations/graph-rag-postgres/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports (1)
1-1: LGTM!integrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjectionIntegrationTests.java (1)
1-173: LGTM!components/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphEmbeddingIndex.java (1)
1-29: LGTM!infrastructure/postgres-rag/01-create-openfga-database.sh (1)
1-45: LGTM!settings.gradle.kts (1)
26-26: LGTM!.github/workflows/ci.yml (1)
39-45: LGTM!integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeMode.java (1)
1-8: LGTM!integrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStoreIntegrationTests.java (2)
50-52: LGTM! Confirmed the non-genericorg.testcontainers.postgresql.PostgreSQLContainerusage matches the current Testcontainers 2.x API rather than being a raw-type mistake.
94-756: LGTM!compose.yaml (1)
60-73: 🎯 Functional CorrectnessNo change needed.
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/ApacheAgeGraphTopologyProjection.java (1)
142-176: 🩺 Stability & AvailabilityNo change needed here.
PostgresGraphProjectionStorewrapsApacheAgeGraphTopologyProjection.replaceRevision()in a singleTransactionTemplate, soSET LOCALis issued inside the same transaction before the subsequent unqualified AGE catalog calls run.integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphVectorIndexManager.java (1)
119-124: The OpenGrep SQL-injection hints here are false positives:CREATE INDEX/DROP INDEXare DDL where identifiers cannot be parameterized, and the concatenated inputs are constrained (constant table names, integerdimension, regex-guardedquoteIdentifier, andquoteLiteral-escapedvchordBuildOptions).Also applies to: 142-143
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/BoundedBatcher.java (1)
13-42: LGTM!integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresVectorIndexStrategy.java (1)
9-15: LGTM!integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptions.java (1)
25-73: LGTM!integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphProjectionStore.java (1)
189-1005: LGTM!integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagAutoConfiguration.java (1)
16-44: Verified against Spring Boot 4 docs: FlywayAutoConfiguration now resides inorg.springframework.boot.flyway.autoconfigure, matching theafterNamestring, so ordering resolves correctly.LGTM!
integrations/graph-rag-postgres/src/main/java/com/orgmemory/graphrag/postgres/PostgresGraphRagProperties.java (1)
10-33: LGTM!integrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/BoundedBatcherTests.java (1)
11-43: LGTM!integrations/graph-rag-postgres/src/test/java/com/orgmemory/graphrag/postgres/PostgresGraphStoreOptionsTests.java (1)
11-35: LGTM!
1 participant
What changed
Why
OrgMemory needs a production-oriented graph projection that follows the useful storage boundaries from LightRAG without allowing a graph or vector store to become an authorization authority. The projection must remain rebuildable, tenant-isolated, permission-scoped, and replaceable by another topology backend such as Neo4j when measured workloads justify it.
Impact
Validation
docker compose config --quietgit diff --checkJetBrains inspection was attempted, but the local IDE MCP transport was unavailable; Gradle compile/test and repository fallback checks were used.
Summary by CodeRabbit
New Features
Documentation
Tests