Fault-injection hooks for the cluster apply protocol, mirroring the
engine’s omnigraph::failpoints pattern. With the failpoints feature
off, every call site compiles to Ok(()).
Config-only cluster apply (Stage 3A): execute the query/policy subset of
the plan against the local cluster catalog. The plan is recomputed under
the state lock, so freshness is structural; the state CAS inside
write_state is the second fence. Graph/schema changes are never executed
here — they are deferred to the graph-lifecycle phase and reported loudly.
Output of config-only cluster apply. “Applied” means recorded in the
local cluster catalog (__cluster/); nothing applied here serves traffic —
the server still boots from omnigraph.yaml until the server-boot stage.
A named cluster embedding provider profile (RFC-012 Phase 5). kind/base_url/
model default exactly as the engine’s EmbeddingConfig::from_env does.
api_key, when required, must be a ${NAME} env reference resolved at
serving boot, never an inline secret.
Record a digest-bound human approval for a gated (irreversible) change —
today: graph deletes. The artifact binds to the exact desired config
digest and the change’s before/after digests, so config or state drift
invalidates it automatically (a stale approval can never authorize a
different change).
List the graph ids applied in a cluster’s served state (sorted). Reads the
ledger only — no catalog validation — like resolve_graph_storage_uri, so
it works on a degraded cluster. Used to enumerate candidates when no
--graph is selected (RFC-011 Decision 7).
Cluster root for a graph storage URI of the cluster layout
(<root>/graphs/<id>.omni), if <root> is actually a cluster (holds
__cluster/state.json); otherwise None. Used by the CLI to refuse
init into a cluster-managed location — graphs there are created by
cluster apply, not init.
Read the applied revision as a serving snapshot — the read-only loader for
the Phase-5 server boot. Cluster-global readiness failures are still
all-or-nothing, but graph-attributed pending recovery sidecars quarantine
only that graph so healthy graphs can continue serving. This loader never
runs a recovery sweep.
Takes no lock: the state file is replaced atomically, so this reads a
consistent point-in-time ledger.
Read the applied revision directly from a storage root URI — config-free
serving: a --cluster s3://bucket/prefix server needs no local files at
all, only the bucket and credentials. The ledger and catalog ARE the
deployment artifact.
Resolve a graph’s storage URI (<root>/graphs/<id>.omni) from a cluster’s
applied state ledger — the lightweight path for storage-plane maintenance
(optimize/repair/cleanup).