Struct ShippedEmbedding 

pub struct ShippedEmbedding {
    pub memory_id: String,
    pub model: String,
    pub dim: usize,
    pub vector: Vec<f32>,
}

#1566 / #1579 B1 — embed-once-replicate-vector. A source-side embedding shipped alongside its memory row in the federation /sync/push payload (wire key crate::models::field_names::EMBEDDINGS).

Wire contract

• The array rides INSIDE the JSON body that sync::post_once serialises once and signs (X-Memory-Sig over the exact body bytes, nonce-bound per #922), so the vector’s TRANSIT integrity is covered by the same Ed25519 signature + replay protection as the memory rows themselves: a vector altered IN FLIGHT invalidates the signature.

  Trust boundary (#1584). The signature attests the SENDER and that the bytes were not altered in transit — it does NOT attest that the f32 values are a well-formed embedding, nor that the vector honestly embeds the shipped (title, content). The content↔vector honesty is an inherent limit of shipping sender-computed vectors (the receiver trusts the enrolled peer not to mislabel). The VALUE DOMAIN, however, is receiver-enforced: sanitize_shipped_vector rejects non-finite components and L2-normalizes the rest before storage, so a peer cannot poison cosine ranking with a NaN/±Inf or high-magnitude vector. (Non-finite components additionally cannot cross the JSON wire at all — serde serialises them to null and the strict Vec<f32> decoder rejects it with 400.)

• Decode is TOLERANT of absence: the receiver’s SyncPushBody field defaults to an empty vec, so pushes from older peers (no embeddings key) and pushes to older peers (unknown fields are ignored — request structs are deliberately permissive per #1052) both interoperate. The fleet swaps as one, but the protocol must not hard-require the field.

Receive contract

The receiver stores vector directly ONLY when dim matches its own configured embedder dimensionality (the same dim-safety property recall’s H7 CosineComparison::DimensionMismatch exists for). On mismatch — or when no vector was shipped — the row falls back to the deferred background-embed path; either way the receiver acks after commit WITHOUT a synchronous embed (~1s/row via ollama pre-#1566, which rode inside the sender’s quorum-ack window and drove the deadline_exceeded → DLQ cascade).

Fields

memory_id: String

Id of the memory row (in the same push) this vector belongs to.

model: String

Human-readable id of the model that produced the vector (sender’s Embedder::model_description()). Observability only — the dim gate is the load-bearing safety check.

dim: usize

Dimensionality the sender claims for vector. Receivers verify dim == vector.len() AND dim == local embedder dim before storing the vector directly.

vector: Vec<f32>

The embedding vector itself.

Implementations

impl ShippedEmbedding

pub fn new(memory_id: String, model: String, vector: Vec<f32>) -> Self

Build a shipped embedding for memory_id from a freshly computed vector; dim is derived from the vector length so the two can never disagree on the sender side.

Trait Implementations

impl Clone for ShippedEmbedding

fn clone(&self) -> ShippedEmbedding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ShippedEmbedding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ShippedEmbedding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for ShippedEmbedding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.