Repository navigation
feat: BYOK is the only embedding source; drop EMBEDDING_PROVIDER - #141
Merged
Merged
Conversation
…switch Embedding now needs only a usable KEK, a Vectorize binding, and an active per-namespace credential. The env var, its unsupported-value warning, the QA wrangler var, and the tests for them are removed. Without a KEK the credential store still fails closed (503, keyword-only), so a deploy without the prod KEK is safe. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the
EMBEDDING_PROVIDERmode switch. BYOK is now the only embedding source; a deployment embeds when a usableEMBEDDING_KEK_V<n>exists and the namespace has an active credential, as before. Removed: the env type and binding reads, the unsupported-value warning, the QA[env.qa.vars]line, and the tests that covered the switch. SDK cache entries now always expire (<=60 s) rather than only under the switch. Docs andsecret-registry.mdupdated.Behavior change on deploy: prod did not set the switch, so BYOK was off there. After this merges and prod deploys, prod is gated only by the KEK: with no
EMBEDDING_KEK_V1the credential store fails closed (credential routes 503, search keyword-only), exactly the prior prod behavior. Provision the prod KEK to turn it on. QA is unchanged (switch was set, KEK provisioned).Verified: typecheck, prettier, 224 tests pass locally.
Not observed: a live QA run of embedding after the change; the QA deploy on merge plus the smoke canary is the gate.
Downstream dependents: none (no OpenAPI or route change).
🤖 Generated with Claude Code