Skip to content

feat(vault): support configurable ENVECTOR_EVAL_MODE (rmp/mm)#60

Draft
heeyeon01 wants to merge 22 commits into
mainfrom
worktree-issue-59-configurable-eval-mode
Draft

feat(vault): support configurable ENVECTOR_EVAL_MODE (rmp/mm)#60
heeyeon01 wants to merge 22 commits into
mainfrom
worktree-issue-59-configurable-eval-mode

Conversation

@heeyeon01
Copy link
Copy Markdown

@heeyeon01 heeyeon01 commented Apr 20, 2026 •
edited
Loading

Context
eval_mode was hardcoded to "rmp" in vault_core.py, blocking users on envector-msa ≥ 1.4.0-alpha which requires "mm" mode. Invalid values also silently propagated to the SDK with an opaque error.

TL;DR
Make FHE eval mode configurable via ENVECTOR_EVAL_MODE env var, with startup-time validation.

Summary

  • vault_core.py: read ENVECTOR_EVAL_MODE env var (default "mm"), validate against allowlist {"rmp", "mm"} in ensure_vault() — invalid values raise ValueError with a clear message at startup
  • docker-compose.yml: expose ENVECTOR_EVAL_MODE=${ENVECTOR_EVAL_MODE:mm} to the container
  • .env.example: document rmp vs mm difference and the key-regeneration requirement
  • tests/unit/test_eval_mode.py: 7 unit tests covering env var reading, ev.init() call args, and allowlist guard behavior

Alternatives

Test plan

  • ENVECTOR_EVAL_MODE unset → defaults to rmp, vault starts healthy
  • ENVECTOR_EVAL_MODE=mm → vault starts healthy
  • ENVECTOR_EVAL_MODE=invalid → ValueError: Invalid ENVECTOR_EVAL_MODE='invalid'. Must be one of: ['mm', 'rmp']... at startup, container exits immediately

heeyeon and others added 4 commits April 17, 2026 12:05
@claude
feat(vault): make eval_mode configurable via ENVECTOR_EVAL_MODE env v…
1325edb 
…ar (#59)

Hardcoded eval_mode="rmp" in vault_core.py prevented connecting to
envector-msa >= 1.4.0 which uses MM (Multi-Multiplication) mode.
Read eval mode from ENVECTOR_EVAL_MODE env var (default: rmp for
backward compat with envector.io cloud / 1.2.x deployments).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
test(vault): verify ENVECTOR_EVAL_MODE env var behavior (#59)
0c0e392 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(vault): add allowlist guard for ENVECTOR_EVAL_MODE (#59)
8356936 
Raise ValueError at startup if ENVECTOR_EVAL_MODE is not one of the
supported values {"rmp", "mm"}, so misconfiguration fails fast with a
clear message instead of propagating an opaque SDK error.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
docs(vault): simplify ENVECTOR_EVAL_MODE description in .env.example (#…
2142ebb 
…59)

Remove cloud/deployment-type framing in favor of version-based guidance,
which stays accurate as envector-msa versions evolve.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@heeyeon01 heeyeon01 self-assigned this Apr 20, 2026
@heeyeon01 heeyeon01 requested a review from a team April 20, 2026 04:39
@jh-lee-cryptolab
Copy link
Copy Markdown
Contributor

jh-lee-cryptolab commented Apr 20, 2026

After envector version v1.4.0, we cannot choose the eval_mode from SDK. If you are planning to test mm mode on vault-side, please use local copy of this repo to deploy it.

@couragehong
Copy link
Copy Markdown

couragehong commented Apr 20, 2026

As Junghwad said + AFAIK, there is no more 'rmp' mode. mm only.
This PR cannot be used

heeyeon and others added 10 commits April 21, 2026 16:01
@claude
feat(install): prompt for ENVECTOR_EVAL_MODE and write to .env (#59)
9fdd216 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(vault): add ENVECTOR_TLS config to control enVector connection s…
5c0b509 
…ecurity (#59)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(vault): pass ENVECTOR_TLS env var through to container (#59)
64e2868 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@heeyeon01
fix(install): update default EMBEDDING_DIM to 1024
431928b
@heeyeon01 @claude
fix(vault): clean up incomplete key state before regeneration (#59)
6b8e354 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@heeyeon01
fix: default ENVECTOR_EVAL_MODE to mm and pass to KeyGenerator
b711b06
@heeyeon01 @claude
fix(vault): skip EvalKey.bin to JSON conversion in MM mode to avoid O…
eececef 
…OM (#59)

pyenvector 1.4.0's generate_keys() unconditionally converts the 849MB
EvalKey.bin to JSON, OOMing containers under ~8GB. The eval key is
unused in MM mode, so monkey-patch KeyManager.eval_bin_to_json to write
a 1-byte dummy instead.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
fix(vault): raise gRPC message limit to fit pyenvector 1.4.0 EvalKey (#…
8b59678 
…59)

Bump MAX_MESSAGE_LENGTH from 256MB to ~1.95GB (under INT32_MAX) so
the ~1.2GB EvalKey produced by pyenvector >= 1.4.0 can be transmitted.
This replaces the MM-mode eval_bin_to_json skip workaround introduced
in eececef, which is no longer needed now that the larger payload
fits within the gRPC limit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
chore(vault): update protovalidate buf dependency
27e8b1c 
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
feat(vault): include ENVECTOR_TLS as envector_secure in public key bu…
620ef48 
…ndle (#59)

Propagate the server's ENVECTOR_TLS setting to agents through the
public key bundle so they can match the Vault's enVector connection
security mode without separate configuration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 heeyeon01 marked this pull request as draft May 6, 2026 06:27
@heeyeon01 heeyeon01 removed the request for review from a team May 6, 2026 06:27
heeyeon01 and others added 8 commits May 6, 2026 15:43
@heeyeon01 @claude
chore(vault): raise container memory limit to 10G and CPU to 2.0
365965e 
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
feat(vault): switch default eval mode to mm32 and index type to IVF_V…
9633d56 
…CT (#59)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@couragehong @claude
fix(vault): remove proto/__init__.py that shadows proto-plus (#59)
dad52be 
Empty vault/proto/__init__.py combined with `vault` on PYTHONPATH made
`vault/proto/` register as a top-level `proto` package, shadowing the
`proto-plus` package that google-cloud libraries depend on. After
pyenvector started importing google.cloud.secretmanager/storage, every
test collection failed with `module 'proto' has no attribute 'module'`.

Drop the empty __init__.py and import the generated stubs as top-level
modules (vault/proto is already on PYTHONPATH).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
fix(install): correct eval mode menu option from "mm" to "mm32" (#59)
26e0af5 
The installer offered "mm" as an eval mode choice, but vault_core only
accepts {"rmp", "mm32"}, so selecting it produced an invalid config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01
Merge branch 'worktree-issue-59-configurable-eval-mode' of github.com…
0ef7da2 
…:CryptoLabInc/rune-admin into worktree-issue-59-configurable-eval-mode
@heeyeon01
Revert "fix(vault): remove proto/__init__.py that shadows proto-plus (#…
839a25a 
…59)"

This reverts commit dad52be.
@heeyeon01 @claude
fix(vault): rename proto/ to _proto/ to escape proto-plus shadow (#59)
cf63171 
vault/ is on PYTHONPATH, so vault/proto/__init__.py made `import proto`
resolve to our empty package instead of the proto-plus PyPI module. With
pyenvector 1.4.0 pulling in google-cloud-secretmanager, `proto.module(...)`
failed at import time — breaking fresh-venv unit test collection and
Docker container startup.

Rename vault/proto/ to vault/_proto/ so the name `proto` no longer exists
in our import path. Update Dockerfile, buf.yaml, proto-gen.sh, .gitignore,
PYTHONPATH in .mise{,ci}.toml, and docs accordingly. Stub imports in
vault_grpc_server.py switch to bare form, matching the style already used
by vault_service_pb2_grpc.py.

This supersedes dad52be (reverted in 839a25a), which deleted __init__.py
without carrying the rename through the rest of the toolchain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@heeyeon01 @claude
feat(vault): tune IVF_VCT index with nlist=256 and default_nprobe=6 (#59
38c4ec9 
)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@heeyeon01 heeyeon01

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@heeyeon01 @jh-lee-cryptolab @couragehong