BE-622: Move semantic search embedding generation into the graph

Add a hash-graph-embeddings crate exposing a provider-agnostic EmbeddingGenerator trait and an OpenAI-backed client (reqwest + reqwest-retry). The graph now resolves a search request's semanticString to an embedding itself, configured via HASH_GRAPH_OPENAI_API_KEY and wired in like the Temporal client, removing the Temporal roundtrip from the Node SDK search path.

The /entities/search and /entity-types/search endpoints accept embedding xor semanticString; the Node SDK searchEntities/searchEntityTypes forward semanticString directly and no longer take a temporalClient. Provider failures are classified (auth/rate-limit/outage) and mapped to appropriate HTTP statuses rather than a blanket 500, a caller-supplied embedding is validated against Embedding::DIM, and startup logs whether semantic search is enabled.

Regenerate the OpenAPI spec, document the sync:turborepo task in AGENTS.md, and wire HASH_GRAPH_OPENAI_API_KEY into the compose graph service.

Author: TimDiekmann

.clippy.toml

@@ -3,5 +3,5 @@ allow-indexing-slicing-in-tests    = true
 allow-print-in-tests               = true
 allow-renamed-params-for           = ["core::fmt::Debug", "core::fmt::Display", "core::fmt::LowerHex", "core::fmt::UpperHex", "core::fmt::Pointer", "futures_sink::Sink", "serde::de::Visitor", ".."]
 avoid-breaking-exported-api        = false
-doc-valid-idents                   = ["BlockProtocol", "HaRPC", "HashQL", "OpenAPI", "PostgreSQL", "OAuth2", ".."]
+doc-valid-idents                   = ["BlockProtocol", "HaRPC", "HashQL", "OpenAI", "OpenAPI", "PostgreSQL", "OAuth2", ".."]
 suppress-restriction-lint-in-const = true

AGENTS.md

@@ -81,6 +81,16 @@ cargo clippy --all-features --package <package-name>
 
 For Rust packages, you can add features as needed with `--all-features`, specific features like `--features=foo,bar`, or use `cargo-hack` with `--feature-powerset` for comprehensive feature testing.
 
+### Monorepo wiring for Rust crates
+
+Each Rust crate has a `package.json` whose **identity and workspace-dependency wiring** — its `@rust/<name>` name, version, and the `dependencies` mirroring its `Cargo.toml` — is generated from `Cargo.toml`. After **adding, removing, or renaming a Rust crate**, or changing its `Cargo.toml` dependencies, re-sync that wiring:
+
+```bash
+mise run sync:turborepo    # sync package.json identity + deps from Cargo.toml metadata
+```
+
+`sync:turborepo` only manages that generated wiring — the `scripts` section is hand-maintained and is used by CI and Turborepo (e.g. `test:unit`, `lint:clippy`, `doc:dependency-diagram`), so add or edit scripts by hand. The task wraps the `repo-chores` CLI; the equivalent direct invocation is `cargo run --package hash-repo-chores --bin repo-chores-cli -- sync-turborepo`. A related task, `mise run fix:package-json`, sorts `package.json` keys consistently.
+
 ## Documentation Maintenance
 
 ### Petrinaut user-facing docs

Cargo.lock

@@ -13,6 +13,7 @@ members = [
     "libs/@local/effect-dns/hickory",
     "libs/@local/graph/api",
     "libs/@local/graph/authorization",
+    "libs/@local/graph/embeddings",
     "libs/@local/graph/migrations",
     "libs/@local/graph/migrations-macros",
     "libs/@local/graph/postgres-store",
@@ -75,6 +76,7 @@ hash-codec.path                     = "libs/@local/codec"
 hash-codegen.path                   = "libs/@local/codegen"
 hash-graph-api.path                 = "libs/@local/graph/api"
 hash-graph-authorization.path       = "libs/@local/graph/authorization"
+hash-graph-embeddings.path          = "libs/@local/graph/embeddings"
 hash-graph-migrations.path          = "libs/@local/graph/migrations"
 hash-graph-migrations-macros.path   = "libs/@local/graph/migrations-macros"
 hash-graph-postgres-store.path      = "libs/@local/graph/postgres-store"
@@ -228,6 +230,7 @@ refinery                           = { version = "0.8.16", default-features = fa
 regex                              = { version = "1.11.2", default-features = false, features = ["perf", "unicode"] }
 reqwest                            = { version = "0.13.0", default-features = false, features = ["json", "rustls"] }
 reqwest-middleware                 = { version = "0.5.0", default-features = false }
+reqwest-retry                      = { version = "0.9.1", default-features = false }
 reqwest-tracing                    = { version = "0.7.0", default-features = false }
 roaring                            = { version = "0.11.2", default-features = false }
 rpds                               = { version = "1.1.2", default-features = false }

Cargo.toml

@@ -18,6 +18,7 @@ harpc-server              = { workspace = true }
 hash-codec                = { workspace = true }
 hash-graph-api            = { workspace = true, features = ["clap"] }
 hash-graph-authorization  = { workspace = true }
+hash-graph-embeddings     = { workspace = true }
 hash-graph-postgres-store = { workspace = true, features = ["clap"] }
 hash-graph-store          = { workspace = true }
 hash-graph-type-fetcher   = { workspace = true }

apps/hash-graph/Cargo.toml

@@ -27,6 +27,7 @@
     "@rust/hash-codec": "workspace:*",
     "@rust/hash-graph-api": "workspace:*",
     "@rust/hash-graph-authorization": "workspace:*",
+    "@rust/hash-graph-embeddings": "workspace:*",
     "@rust/hash-graph-postgres-store": "workspace:*",
     "@rust/hash-graph-store": "workspace:*",
     "@rust/hash-graph-type-fetcher": "workspace:*",