PERF-ONT-004 — Bound model and context cardinality
| Field | Value |
|---|---|
| Status | Open finding; source-verified; scale boundary pending |
| Severity | High |
| Components | sparqd/ontology, Cube, PostgreSQL, sparqd/platform-stacks |
| Associated issues | Not opened pending finding review |
Concrete observed case
Ontology resolves the complete effective model before Cube load, dry-run, SQL, and metadata calls even though proxy token creation needs only branch metadata. Cube then calls repository and schema-version, which each resolve it again; schema-version serializes and hashes it.
Compiler state is per project/branch. The orchestrator key includes user, project, branch, and a five-minute token bucket, multiplying queues, caches, drivers, and churn as users and branches grow.
Expected condition
Lightweight revision/security lookup is separate from immutable model materialization. One snapshot keyed by project, branch, and revision serves repository and schema-version. Compiler/orchestrator contexts have measured cardinality, expiry, and limits while user data policy remains isolated.
Why it matters
Repeated database and serialization work can dominate request latency. Horizontal replicas can repeat rather than remove the amplification.
Existing controls and workarounds
Runtime loading reaches the complete model, and context keys preserve isolation. Neither bounds work or context growth.
Alternatives considered
- Recommended: revision-keyed model artifacts, event invalidation, and lightweight token context.
- Distributed TTL cache — useful if keys include revision and failures cannot silently serve the wrong model.
- More replicas — only after removing repeated work and distributing state.
Component involvement
- Ontology produces and caches revisioned model artifacts.
- PostgreSQL supports bounded revision/model retrieval.
- Cube limits contexts while preserving user security.
- Platform stacks provides distributed queue/cache and scaling controls.
Reproduction and verification
Follow ONT-S019.
Resolution conditions
Close when model calls and bytes per semantic request are bounded, invalidation is revision-correct, and supported context cardinality meets measured targets.
Validation and blockers
Repeated loading and context keys are source-confirmed. Production cardinality and representative model-size benchmarks are unavailable.