[indietyp]

🌟 Purpose

Refresh container CA trust and select it for Node.js in both build and runtime stages, including package downloads. Use the same store for the optimizer's gRPC telemetry. Both otherwise keep using bundled roots when the container's CA bundle changes.

Preserve inherited NODE_OPTIONS in production start scripts alongside the existing heap limit, so the container's CA selection reaches the application.

🚫 Blocked by

• SRE-1216: Update TLS trust dependencies #10124

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Oct 21, 2026 12:29pm UTC
petrinaut	Ready	Preview	Oct 21, 2026 12:29pm UTC
petrinaut-docs	Ready	Preview	Oct 21, 2026 12:29pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Oct 21, 2026 12:29pm UTC

[cursor]

PR Summary

Medium Risk
Changes affect TLS verification for outbound HTTPS/gRPC and auth compose services; mis-versioned base images could fail builds, and CA policy shifts could break rare legacy chains until upstream Node/Kratos/Hydra catch up.

Overview
Hardens TLS trust across Docker images after compromised eMudhra roots: builds now require a minimum ca-certificates package version, and Node-based images set NODE_OPTIONS=--use-openssl-ca so Node uses the OS bundle instead of its embedded store (temporary until a fixed Node release; SRE-1221).

Production start scripts for hash-api, hash-ai-worker-ts, and hash-integration-worker prepend existing NODE_OPTIONS before the heap limit so image-level CA settings are not wiped at runtime.

petrinaut-opt installs a refreshed CA bundle in the runner and points gRPC at /etc/ssl/certs/ca-certificates.crt via GRPC_DEFAULT_SSL_ROOTS_FILE_PATH. Compose Hydra disables the affected Mozilla/emSign cert in ca-certificates.conf; Kratos overlays a Debian-built ca-certificates.crt on the distroless image (SRE-1231). Atlas CUDA stages get the same minimum ca-certificates gate.

^{Reviewed by Cursor Bugbot for commit 7d3d006. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.04%. Comparing base (8b1cbc2) to head (7d3d006).
⚠️ Report is 9 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #10130   +/-   ##
=======================================
  Coverage   68.03%   68.04%           
=======================================
  Files        2006     2006           
  Lines      206233   206219   -14     
  Branches     8796     8790    -6     
=======================================
+ Hits       140312   140313    +1     
+ Misses      64253    64238   -15     
  Partials     1668     1668           

Flag	Coverage Δ
hash-graph	21.07% <ø> (ø)
hash-graph-atlas	80.03% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit df1aed3. Configure here.}

[github-actions]

Benchmark results

hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.9 \mathrm{ms} \pm 263 \mathrm{μs}\left({\color{gray}2.00 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.12 \mathrm{ms} \pm 22.9 \mathrm{μs}\left({\color{gray}3.47 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$13.0 \mathrm{ms} \pm 113 \mathrm{μs}\left({\color{gray}3.94 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$40.1 \mathrm{ms} \pm 481 \mathrm{μs}\left({\color{red}5.28 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$13.0 \mathrm{ms} \pm 140 \mathrm{μs}\left({\color{red}6.56 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$22.8 \mathrm{ms} \pm 221 \mathrm{μs}\left({\color{gray}4.84 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$28.5 \mathrm{ms} \pm 194 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.39 \mathrm{ms} \pm 23.0 \mathrm{μs}\left({\color{gray}3.82 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$13.6 \mathrm{ms} \pm 134 \mathrm{μs}\left({\color{gray}1.47 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.38 \mathrm{ms} \pm 26.8 \mathrm{μs}\left({\color{gray}-1.862 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.64 \mathrm{ms} \pm 17.9 \mathrm{μs}\left({\color{gray}-0.308 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$2.96 \mathrm{ms} \pm 20.4 \mathrm{μs}\left({\color{gray}-0.964 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$4.71 \mathrm{ms} \pm 35.5 \mathrm{μs}\left({\color{gray}-1.773 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.17 \mathrm{ms} \pm 25.2 \mathrm{μs}\left({\color{gray}0.210 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$3.71 \mathrm{ms} \pm 32.4 \mathrm{μs}\left({\color{gray}-1.338 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.00 \mathrm{ms} \pm 34.7 \mathrm{μs}\left({\color{gray}-0.108 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.03 \mathrm{ms} \pm 17.8 \mathrm{μs}\left({\color{gray}0.470 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$3.64 \mathrm{ms} \pm 33.5 \mathrm{μs}\left({\color{gray}-2.800 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.39 \mathrm{ms} \pm 16.6 \mathrm{μs}\left({\color{gray}1.25 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.37 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}1.29 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.46 \mathrm{ms} \pm 20.6 \mathrm{μs}\left({\color{gray}1.42 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.65 \mathrm{ms} \pm 18.2 \mathrm{μs}\left({\color{gray}2.36 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.53 \mathrm{ms} \pm 19.0 \mathrm{μs}\left({\color{gray}0.719 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.77 \mathrm{ms} \pm 20.5 \mathrm{μs}\left({\color{gray}2.33 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$2.69 \mathrm{ms} \pm 24.3 \mathrm{μs}\left({\color{gray}0.376 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.47 \mathrm{ms} \pm 14.1 \mathrm{μs}\left({\color{gray}0.211 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$2.57 \mathrm{ms} \pm 17.5 \mathrm{μs}\left({\color{gray}-0.096 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.11 \mathrm{ms} \pm 22.0 \mathrm{μs}\left({\color{gray}0.663 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$2.68 \mathrm{ms} \pm 17.2 \mathrm{μs}\left({\color{gray}0.572 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$2.86 \mathrm{ms} \pm 19.3 \mathrm{μs}\left({\color{gray}-1.185 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.00 \mathrm{ms} \pm 27.1 \mathrm{μs}\left({\color{gray}-0.177 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.65 \mathrm{ms} \pm 13.0 \mathrm{μs}\left({\color{gray}-1.270 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$2.90 \mathrm{ms} \pm 23.0 \mathrm{μs}\left({\color{gray}0.446 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$30.6 \mathrm{ms} \pm 224 \mathrm{μs}\left({\color{gray}1.75 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$67.9 \mathrm{ms} \pm 497 \mathrm{μs}\left({\color{gray}1.65 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$33.4 \mathrm{ms} \pm 196 \mathrm{μs}\left({\color{gray}0.763 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$38.0 \mathrm{ms} \pm 245 \mathrm{μs}\left({\color{gray}1.73 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$39.5 \mathrm{ms} \pm 294 \mathrm{μs}\left({\color{gray}-1.363 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$32.1 \mathrm{ms} \pm 218 \mathrm{μs}\left({\color{gray}1.68 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$398 \mathrm{ms} \pm 1.30 \mathrm{ms}\left({\color{gray}0.260 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$82.3 \mathrm{ms} \pm 663 \mathrm{μs}\left({\color{gray}-0.711 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$81.1 \mathrm{ms} \pm 599 \mathrm{μs}\left({\color{gray}-0.159 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$245 \mathrm{ms} \pm 845 \mathrm{μs}\left({\color{lightgreen}-10.074 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$9.68 \mathrm{ms} \pm 67.8 \mathrm{μs}\left({\color{gray}-3.152 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$9.74 \mathrm{ms} \pm 62.4 \mathrm{μs}\left({\color{lightgreen}-5.046 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$9.86 \mathrm{ms} \pm 58.1 \mathrm{μs}\left({\color{gray}-4.126 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$9.79 \mathrm{ms} \pm 62.1 \mathrm{μs}\left({\color{gray}-4.041 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$9.67 \mathrm{ms} \pm 60.1 \mathrm{μs}\left({\color{gray}-4.588 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$9.53 \mathrm{ms} \pm 62.1 \mathrm{μs}\left({\color{gray}-3.999 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$9.55 \mathrm{ms} \pm 64.1 \mathrm{μs}\left({\color{gray}-1.488 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$9.55 \mathrm{ms} \pm 58.2 \mathrm{μs}\left({\color{gray}-4.648 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$9.85 \mathrm{ms} \pm 61.3 \mathrm{μs}\left({\color{gray}-2.091 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$10.0 \mathrm{ms} \pm 72.8 \mathrm{μs}\left({\color{gray}-3.457 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$9.93 \mathrm{ms} \pm 64.5 \mathrm{μs}\left({\color{gray}-3.343 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$10.1 \mathrm{ms} \pm 69.0 \mathrm{μs}\left({\color{gray}-0.411 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$9.81 \mathrm{ms} \pm 61.0 \mathrm{μs}\left({\color{gray}-4.204 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$9.87 \mathrm{ms} \pm 68.3 \mathrm{μs}\left({\color{gray}-3.284 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$9.91 \mathrm{ms} \pm 55.2 \mathrm{μs}\left({\color{lightgreen}-5.303 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$9.93 \mathrm{ms} \pm 51.9 \mathrm{μs}\left({\color{gray}-1.335 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$9.82 \mathrm{ms} \pm 56.8 \mathrm{μs}\left({\color{gray}-3.025 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$9.86 \mathrm{ms} \pm 64.4 \mathrm{μs}\left({\color{gray}-2.454 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$9.79 \mathrm{ms} \pm 56.3 \mathrm{μs}\left({\color{gray}-4.480 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$7.61 \mathrm{ms} \pm 51.5 \mathrm{μs}\left({\color{gray}4.50 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$58.0 \mathrm{ms} \pm 449 \mathrm{μs}\left({\color{gray}1.23 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$105 \mathrm{ms} \pm 562 \mathrm{μs}\left({\color{gray}-3.174 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$63.9 \mathrm{ms} \pm 469 \mathrm{μs}\left({\color{gray}1.13 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$73.0 \mathrm{ms} \pm 522 \mathrm{μs}\left({\color{gray}2.46 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$81.7 \mathrm{ms} \pm 646 \mathrm{μs}\left({\color{gray}0.998 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$87.6 \mathrm{ms} \pm 493 \mathrm{μs}\left({\color{gray}-0.241 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$43.8 \mathrm{ms} \pm 257 \mathrm{μs}\left({\color{gray}-3.983 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$69.6 \mathrm{ms} \pm 525 \mathrm{μs}\left({\color{gray}-1.872 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$49.6 \mathrm{ms} \pm 332 \mathrm{μs}\left({\color{gray}-4.692 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$58.1 \mathrm{ms} \pm 530 \mathrm{μs}\left({\color{gray}-1.759 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$59.6 \mathrm{ms} \pm 502 \mathrm{μs}\left({\color{gray}-2.081 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$60.3 \mathrm{ms} \pm 572 \mathrm{μs}\left({\color{gray}-1.697 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$110 \mathrm{ms} \pm 758 \mathrm{μs}\left({\color{red}9.16 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$120 \mathrm{ms} \pm 763 \mathrm{μs}\left({\color{red}6.92 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$21.5 \mathrm{ms} \pm 159 \mathrm{μs}\left({\color{gray}0.414 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$473 \mathrm{ms} \pm 1.38 \mathrm{ms}\left({\color{gray}1.02 \mathrm{\%}}\right) $$	Flame Graph