[coodos]

Problem

By-ID reads and updates take 6–9 seconds when _acl grants access through group membership. The membership query in GroupMembershipService.membersOf() scans every MetaEnvelope (1,789,882 in production) to reach 2,959 Group/Chat records.

Fix

Adds an index on MetaEnvelope.ontology, created at startup with the other indexes, so the lookup seeks straight to group records. membersOf() is unchanged, so finding a group by its ename field still works.

Envelope.value is deliberately not indexed: it holds arbitrary payloads, and an oversized value could make writes fail.

Testing

Benchmark on 1M unrelated records plus 3k groups (Neo4j 5.15; 4.4 was similar):

Query	Plan	DB hits	Time
Before	NodeByLabelScan	~2,030,000	~130–170 ms
After	NodeIndexSeek	~27,000	~10 ms

These runs reproduce the scan but not production's latency, so the times don't predict production times.

• Membership specs pass (13), including a new query-plan test that fails when the index is missing.
• The rest of the evault-core suite was not run.

After deploying

Not yet verified on production. Member requests stay slow until the index finishes building on those 1.79M nodes.

• SHOW INDEXES lists meta_envelope_ontology_index as ONLINE
• Rerun the reproduction as a member and confirm the latency drop

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4fd5f415-8a62-41ee-9b6a-9ac95e5b6fa1

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T16:09:17.878777Z	32a7ee4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.