Repository navigation
atlas-search: nix packaging + disabled deploy (step 5, #5355) - #5439
Merged
Merged
Conversation
added 3 commits
November 4, 2026 06:11
![developing-today[bot]](https://s.lequ.pw/_assets/images/gravatars/gravatar-user-420.png){kind=avatar}
…ult (step 5, #5355) fetch-model provisions the pinned Snowflake snapshot (HF rev 95c2741480856aa9666782eb4afe11959938017f; tokenizer.json + onnx/model.onnx, sha256 recorded in-source per the Q1 ruling — state-dir fetch, not a nix FOD) into ~/.local/state/atlas-search/model/<rev>/: streamed download with inline sha256, verify-before-install, staging dir + atomic rename promote, idempotent no-op on a verifying snapshot, loud refusal on hash mismatch, and a mkdir provisioning lock so concurrent runs cannot interleave writes into the shared staging dir (race observed live during step-5 verification; a killed run leaves the lock and the error says how to clear it). resolve_ort_lib gains a final compile-time fallback from ATLAS_SEARCH_ORT_LIB_DEFAULT so the nix package bakes its closure onnxruntime path in. Fixtures: make_fixture_db.py + smoke_check.py, the install-check harness (FTS/hybrid envelopes byte-compared to the Python recordings; ORT-load probe proves ort::init_from succeeds from the baked path).
buildRustPackage on the repo-pinned rust-overlay toolchain (rust-toolchain.toml via the sub-flake and via the home wiring), cargoLock from the workspace lockfile. The closure carries onnxruntime (env ATLAS_SEARCH_ORT_LIB_DEFAULT points at its libonnxruntime.so; libstdc++/libz ride the stdenv closure and the ORT lib itself), so the packaged binary needs no host LD_LIBRARY_PATH. doInstallCheck runs fixtures/smoke_check.py against the built binary. flake.nix is a thin standalone wrapper (nixpkgs + rust-overlay + flake-utils) so the package also builds outside the fleet flake.
systemd.user.services.atlas-search runs the packaged binary (serve, default 127.0.0.1:18760 — inventoried free against the 18742-18752 proxy range and live listeners). Landed DISABLED: no Install section, so the unit cannot be enabled until step 6 (#5356) adds WantedBy, runs init for the real client tokens, and creates the tailscale serve mapping (recorded in the unit comment; serve state is imperative tailscaled state with no declarative precedent in the repo). The package is deliberately not in home.packages: the Python wrapper at ~/.local/bin/atlas-search remains the resolved atlas-search CLI until the step-6 cutover.
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 55 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Nov 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Atlas step 5 of epic #5350 (issue #5355): nix packaging + deploy of the atlas-search binary, landed disabled. Activation (enable + start + client cutover) is step 6, #5356.
What lands
atlas-search fetch-model(new verb): provisions the pinned Snowflake snapshot per Drew's Q1 ruling — HFSnowflake/snowflake-arctic-embed-m-v2.0@ rev95c2741480856aa9666782eb4afe11959938017f, only the two files the embedder loads, sha256 recorded in-source (tokenizer.jsonf1cc44ad…,onnx/model.onnxc0c53d7f…) — into~/.local/state/atlas-search/model/<rev>/. Streamed download with inline hash, verify-before-install, staging dir + atomic rename promote, idempotent no-op on a verifying snapshot, loud refusal on mismatch, and a mkdir provisioning lock so concurrent runs can't interleave writes into the shared staging dir (race observed live during verification; a killed run leaves the lock and the error says how to clear it). Explicitly NOT a nix FOD.pkgs/atlas-search(+ standalone sub-flake):buildRustPackageon the repo-pinned rust-overlay toolchain. The closure carries onnxruntime;ATLAS_SEARCH_ORT_LIB_DEFAULTbakes itslibonnxruntime.sopath into the binary as the lastresolve_ort_libfallback, so no hostLD_LIBRARY_PATHis needed.doInstallCheckrunsfixtures/smoke_check.py: FTS + hybrid envelopes byte-compared against the Python recordings, plus an ORT-load probe provingort::init_fromsucceeds from the baked path.systemd.user.services.atlas-search(serve,127.0.0.1:18760— inventoried free against the 18742–18752 proxy range and live listeners) with noInstallsection — it cannot be enabled until step 6 addsWantedBy, runsinitfor the real client tokens, and creates the tailscale serve mapping (recorded in the unit comment; serve config is imperative tailscaled state, no declarative precedent in the repo). The package is deliberately not inhome.packages: the Python wrapper stays the resolvedatlas-searchCLI until cutover.Verification (from the packaged artifact, clean env)
nix-store -qR): onnxruntime-1.27.1, gcc-16.2.0-lib (libstdc++.so.6), zlib-1.3.2.fetch-modelrun on the laptop: both files sha256-verified into the real state dir (independently re-hashed with sha256sum); re-run is a verified no-op (mtime unchanged).env -i, HOME+PATH only) standalone search against production read-only matches the Python CLI's top-10 exactly, back-to-back (the corpus is being rewritten live by the index work, so sequential comparisons minutes apart can legitimately differ; controlled back-to-back runs agree).initwrites service.json 0600 with the v1 client table; /health 200; via-service search works; an identical repeat is a dedupe hit (17.5s → 0.0s, identical results); scratch service stopped, port released.is-enabled: not-found), no real~/.config/atlas-search/client.json, Python wrapper untouched.Note: nixpkgs' onnxruntime is 1.27.1 vs the Python pipeline's 1.31.1 — numeric bit-identity adjudication belongs to step 6's Gate B golden parity, not this step.
🤖 Generated with Claude Code
Open in [code]smith · Need help on this PR? Tag
@codesmith-botwith what you need.