What's new¶

Implementation update, 16 October 2026¶

This update reviews the source history since 15 September through a3622025. The entries below describe implemented behavior, not confirmation that an existing deployment or downloaded trial contains it. Check your image's source revision before relying on a new endpoint. The trial build underway during this documentation update is not a completed release acceptance test.

API and security changes¶

Area	Current behavior	Upgrade consideration
Governed commits	Signed decision evidence, per-object version checks, atomic outbox intents, and idempotent receipts. New reads expose snapshots, visible object versions, and stored receipts.	Use the same mutation UUID for retries. Snapshot indices are store-wide; use object versions for independent edits. See Governed commits.
RDF 1.2 governed facts	`triple_term` objects work in inserted/deleted facts and required/absent preconditions, with eight-level nesting.	Complete the rollout before clients submit the new wire variant.
Workspaces	Projects, scoped MCP bindings, verified owner SIDs, and use cases that combine 1 to 100 projects.	Sharing never grants source-document access. Metadata edits remain last-writer-wins. See Workspaces.
Graph authorization	Graph globs, exclusions, exclusive service-token writers, and a separate default for machine identities.	Review broad grants and configure `service_token_default_access` explicitly. See ACL filtering.
ACL reads and repairs	Reads retain their starting ACL generation within bounded history. Known malformed targets are denied locally; unknown targets still block the projection.	Revocation applies to the next query. Monitor `ig_acl_faulted_triples` and retry unavailable projections.
Identity and administrative access	Additional OIDC issuers resolve by verified issuer. Native machine identities bind to canonical tenants and verified actor inputs. Metrics require Admin or the configured scrape identity.	Update monitoring credentials and verify tenant claims. No identity header overrides an authenticated tenant.
Context graphs	Retraction removes selected slices from canonical facts and the hybrid-search projection. Asset-status weighting is opt-in.	Retraction is a write, and status weighting cannot widen ACLs. See Context graphs.

Direct writes to governed asset status, status history, and release manifests are guarded separately from ordinary graph Write permission. A successful SPARQL write or commit does not certify an ontology release activation.

Search changes¶

Tantivy is now the default text engine for embedded single-process stores. Remote stores retain the general engine unless explicitly configured otherwise. Writes update affected document IDs incrementally. The standalone persistent index uses a crash-safe watermark; it remains a projection, not an independent source of truth. Filter-only browsing, exact keyword matching, missing-field presence, highlighting, and mapped numeric/date sorting have dedicated paths. Query work is cancelled when its caller disconnects.

Index templates are stored and applied, including during auto-create. Mapping updates add keyword/filter fields with guarded catalog changes and background backfill. The API also adds field capabilities, live scroll, search_after, interval queries, and a bounded script_score subset. These additions do not make the API a complete Elasticsearch or Kibana replacement.

Earlier public examples of _ext.sparql_enrich, _ext.kg_boost, and SPARQL filters were incorrect: _ext is ignored. Use the opt-in SPARQL SERVICE <urn:indentia:search> instead. See the Elasticsearch API reference.

Exact kNN still evaluates the complete allowed source-vector set. Certified float vectors can be ranked in memory when filters and ACLs resolve to IDs. Quantized HNSW uses int8 graph storage and source rescoring for ANN; its exact path reads source floats. int4_hnsw and bbq_hnsw currently use int8 storage too. See Vector search for the memory and scoring boundaries.

Operations and reliability¶

Bounded canonical LPG queries apply tenant and triple ACLs before projecting one complete named graph. Seeded Leiden runs on that scope. Resumable vector generations have a replicated build catalog, while local ANN files remain separately validated artifacts.
Embedded SurrealKV block caches and memtables are bounded relative to the memory limit. Search and bulk requests also use a parent memory circuit breaker.
Raft log append no longer waits behind state-machine apply. Snapshots stream through files on the data volume, serialize off the async runtime, and check the memory ceiling before allocating copies. Oversized snapshot builds are deferred instead of stopping RaftCore.
HNSW files persist durably and validate freshness on reopen. Corrupt ID-map metadata triggers repair rather than trusting stale vector identities.
Native schema introspection retains STRICT. Catalog fingerprints, administrative SQL admission, and tenant replay reads have additional guards.
Simulated webhook, Slack, and email actions now report failed delivery. Configured action syntax does not prove an external notification was sent. See Alerting.
Runtime and dependency updates include curl, rustls, quinn-proto, ammonia, and the WASM zstd decoder. Use the scan and signing results for your exact image; this list is not a vulnerability-free claim.

The performance page retains the 11 October load-test setup and its limits. These correctness and resource changes introduce no new throughput, capacity, recall, or production-availability guarantee.

September 2026 update¶

The sections below describe the earlier changes since 9 August. Keep their validation dates and source revisions separate from the October implementation update.

Search and storage — 20 September 2026¶

This describes the implementation update, not confirmation that an existing deployment or a previously downloaded trial image has been upgraded.

Upstream integration and cluster distribution¶

The embedded SurrealDB dependency advances from ceac161412 (3.2.0-nightly) to 18971ffba (3.3.0-nightly), incorporating 118 committed upstream changes. The three-way integration retains IndentiaDB's full-text filter corrections, bounded scans and index cleanup, compact RDF indexes, optional LZ4 and WAL recovery fixes. Exact search, HNSW and DiskIVF remain separate search choices. Upstream DiskANN is not IndentiaDB's DiskIVF implementation.

Local validation passed 4,801 integration tests; the combined upstream and distribution suite passed 8,770 tests (13 skipped). The additional three-process split test passed with leader failure and reopening of child shards. A separate on-disk upgrade check writes with 3.2, reopens with 3.3, verifies RDF values and HNSW results, then tests compact-index migration, updates and deletes. A downgrade after new-version writes is not certified; retain the corresponding checked backup.

The separate cluster v10 / metadata v6 changes keep the two Raft layers and existing routing hash. Zone labels enforce failure-domain isolation; allocation uses size and request traffic; bounded periodic digest pages detect replica disagreement at a common Raft position. Online splits copy native tenant RDF while writes continue, then fence writes briefly and verify all assigned replicas before switching routing. See High Availability. This format change requires its own controlled migration and is not part of the v9 storage-repack rollout.

Change	Result	Operational boundary
Exact kNN by default	`exact: true` evaluates all permitted source vectors, with filters and ACLs applied before ranking.	Cost grows with the allowed scope. Selecting DiskIVF alone does not enable ANN.
HTTP/retriever mode preservation	Top-level kNN, multiple kNN clauses and hybrid RRF retain an explicit `exact: false` through to the search engine.	Fixes an unintended full scan; ANN remains approximate.
DiskIVF quality	`exact: false` selects a larger candidate set and reranks it using original source vectors.	Exact candidate scores do not guarantee the true global top-k.
Bounded DiskIVF work	Streaming training/input, bounded candidates, posting pages and up to four concurrent page reads.	Page/cache budgets are not total process-memory limits.
Raft and shard checks	Search generations track applied log positions and repair epochs; stale projections and missing required shards fail closed.	This is not an atomic snapshot across independent Raft groups.
Compact RDF indexes	Hash index keys replace repeated long subject/object values; full RDF terms and document text remain stored.	Existing populated stores require an offline migration.
Optional LZ4, enabled by default	Compresses large value-log values only when worthwhile, with checksums and bounded decoding.	Disabling it affects new writes; old binaries cannot read the new compressed format.
Verified offline repack	Copies live keys across all namespaces/tables in bounded batches, reopens the output and compares its count, byte count and SHA-256.	Non-versioned stores only; no automatic source deletion or directory swap.

On a fixed synthetic corpus of 1,000 vectors, 64 dimensions and 20 queries, DiskIVF recall@10 improved from 65.5% to 100% with 100 candidates. This is a regression fixture, not a recall guarantee. Separate local storage fixtures measured 76.6% less storage after compact RDF indexing and 75.3% less value-log space with LZ4; these percentages must not be added or extrapolated to a live corpus. The LZ4 fixture's median read/write times differed by less than 3% with the OS page cache warm.

The storage maintenance implementation passed 14,755 CI tests (67 skipped), release build, scanning and image signing in pipeline 67809, and 1,036 local SurrealKV tests (3 ignored). Production capacity, cold-read latency, p95/p99 and prolonged ingestion/recovery at large scale still require representative measurements. Online retirement of old ANN generations and more efficient posting mutations remain open work. DiskIVF is not a port of Elasticsearch DiskBBQ or DiskHIVF.

Use Vector Search & RAG for the search contract and Storage Maintenance for migration, compression settings and rollback constraints.

Breaking Changes & Upgrade Notes¶

Upgrade clusters blue/green

The cluster command format moved from v7 to v9 (v8 adds base-index attach and strict set semantics for the live overlay; v9 adds conditional publication updates). Nodes only activate a new format once every voter advertises it, but activation is one-way per data directory — a node cannot be downgraded to an older image afterwards. Plan a blue/green upgrade (or keep cold copies of the data directories) as described in High Availability.

Change	What to check
Raft timing defaults raised from 150/300/500 ms to 1000/3000/5000 ms (heartbeat / election min / election max), including the operator CRD defaults.	Worst-case leader failover is now ~3–6 s. Explicit `[cluster]` timings still override the defaults; a heartbeat below 1000 ms logs a warning at startup.
Explicit role permission wins over `[authorization].default_permission`. Previously the higher of the two applied.	Principals with a reader or writer role on a deployment whose default is `admin` no longer get Admin — including on Admin-only endpoints. See Authorization.
`:9200` document writes in cluster mode require `IG_ES_RDF_SOT=true`. Without it they return `503 cluster_block_exception`.	Enable RDF-as-source-of-truth for HA deployments that write through the Elasticsearch API. A development-only escape hatch exists; production refuses to boot without SOT. See Elasticsearch API.
Fail-loud cluster boot. A node refuses to start without a working shard reconciler, without a durable shard data root, or with legacy per-shard WAL files that still contain records.	Make sure `/data` is on persistent storage and migrate or retire old shard WALs before upgrading. See High Availability.
`IG_PRODUCTION` boot audit. Dangerous escape hatches (e.g. relaxed Raft log or WAL sync, recovery `ignore`/`truncate` modes, insecure in-cluster OIDC HTTP) are refused, with all violations reported in one error.	Remove the flagged settings or acknowledge a one-off recovery explicitly. See Production Hardening.
Document-level security on `:9200` is server-stamped. Allowed principals come only from the server-maintained ACL field; documents without an ACL are stamped public once per index, and ACL bookkeeping fields are hidden from `_source`.	Clients can no longer widen visibility through the request body. See Elasticsearch API.
SPARQL TSV results follow the specification (full N-Triples terms, `?`-prefixed header, escaping), and TSV/CSV columns follow the `SELECT` projection order.	Update TSV parsers that relied on the previous shape.
Stricter SPARQL 1.2 parsing. Aggregates in invalid scopes and invalid triple-term/IRI tokens are rejected; `xsd:date`/`time`/`duration` values now compare and support `YEAR`/`MONTH`/`DAY`.	Queries that were silently accepted before may now return a parse error. See SPARQL 1.2.
Federation allowlist patterns are stricter. A `*` glob no longer matches across the URL authority, and credential patterns without a scheme are refused.	Review `IG_SPARQL_FEDERATION_ALLOWLIST` entries. See Federated Queries.
OIDC identities are issuer-scoped. The user SID comes from `user_sid_claim` or is derived from issuer and subject; synthetic SIDs use a new key format, and subject-only ACL entries no longer match OIDC users.	Re-check ACL grants that referenced synthetic SIDs or bare subjects. See Authentication.

Query Engine¶

Temporal joins are up to three orders of magnitude faster. TEMPORAL AS OF joins switch to a bulk fetch plus in-memory hash join above a configurable number of input bindings, with results identical to the previous evaluation. STRSTARTS/STRENDS are now supported in temporal queries, and OPTIONAL with a FILTER keeps its left-hand rows. See Bitemporal Queries.
UPDATE planning uses dataset statistics, so DELETE … WHERE requests with OPTIONAL reifier cleanup no longer scan whole graphs.
Faster aggregates and reads: exact COUNT and GROUP BY ?g can be answered from maintained counters, redundant DISTINCT is eliminated, and long scans no longer block concurrent writes.
Federation (opt-in) gained per-endpoint credentials, an explicit switch for private in-cluster peers, VALUES pushdown on all evaluation paths, timeout budgets and clear HTTP statuses (501/403/502/504). See Federated Queries.

APIs¶

Conditional publication on /update with an optimistic version precondition (HTTP 409 when it loses).
Write rate limiting per actor on /update (opt-in), answering 429 with Retry-After.
POST /vector/topk for bounded, ACL-aware chunk retrieval, and POST /stream/ingest for offset-ordered event ingestion.
Exports: streamed N-Quads for the full dataset, an RDF 1.2 export that can wait for a minimum snapshot index, and an explicit skip_invalid mode that reports what it left out.
Workspace expansion paging for large collections, with machine-readable collection_too_large and invalid_cursor errors.

All contracts are in SPARQL & REST Endpoints.

Elasticsearch-Compatible API¶

Document-level security is enforced inside retriever fusion, backed by an ACL bitset prefilter.
More query shapes stay on the fast WAND path: keyword, bool, exists and nested filters, multi_match and minimum_should_match > 1.
Clear limits and errors: capped _mget, 409 version_conflict_engine_exception on write conflicts, immediate empty results for unmapped fields, ignore_unmapped on nested queries.
Field names, ids and sort keys are validated and escaped end to end.

See Elasticsearch API and Enterprise Search.

Security¶

A single production boot audit, durable hash-chained audit logging with fail-closed readiness, and cluster join identity checks. See Production Hardening.
Service tokens can declare explicit principals; tenant claims are authoritative. See Authorization.
ACL maintenance reports every malformed security annotation in one pass and retries rebuilds that raced a concurrent write. See Triple-Level ACL.

Cluster, HA & Operations¶

Graceful leader handoff on shutdown (opt-in), readiness responses with explicit reasons, and a separate liveness endpoint.
Torn Raft log protection (optional log framing, durable sync by default in production, boot-time recovery of uncommitted tails).
Snapshot controls: snapshot cadence settings plus Admin endpoints to force a snapshot.
Opt-in write pipelining and online vocabulary/tombstone garbage collection.
Sharding: transparent tenant routing on /sparql and /update, correct cross-shard joins with memory/row/time budgets, safer shard promotion and meta-WAL checkpoints.
Base-index attach for HA clusters.
Derived projections resume from a certified watermark and repair dropped updates without a full rebuild.

See High Availability, Scale & Sharding and Architecture.

Backup & Disaster Recovery¶

Fixed three-node Backup Set v2 with incarnation fencing (CLI-driven; the operator resource is in preview).
Opt-in cluster backup sets and point-in-time recovery (WAL/Raft archive to S3) with matching CLI commands.

See Backup & Disaster Recovery and the CLI Reference.