Isolate cloud model access before enabling product RAG workflows

The API and ingestion tools now use a fixed internal model gateway while
governed profiles, embedding cache assignments, traceable citations, and
stable API errors establish the boundaries required by later workflows.

Constraint: The current Alibaba Cloud workspace rejects all three live model calls with authentication failures
Rejected: Give the API or seed tools the Bailian key and direct egress | combines database access, cloud credentials, and public network access
Rejected: Mix offline and Bailian vectors in one demo namespace | makes profile activation and retrieval ambiguous
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep Bailian credentials and egress exclusive to model-gateway and create a new immutable profile hash for any embedding identity change
Tested: make verify; 121 backend tests; 14 frontend tests; fresh and populated Alembic upgrade-downgrade-upgrade; two idempotent offline seeds; Docker health and HTTP retrieval; isolated provider smoke
Not-tested: Successful live Bailian responses because the supplied workspace credential currently fails authentication

backend/tests/unit/test_provider_smoke.py

@@ -1,5 +1,6 @@
 import pytest
 
+from app.adapters.model_gateway import ModelGatewayAdapter
 from app.core.config import Settings
 from app.ports.model_providers import ModelProviderError, ProviderErrorKind
 from app.tools import provider_smoke
@@ -19,28 +20,23 @@ def test_provider_smoke_settings_accept_compose_embedding_dimension(
 async def test_provider_smoke_entrypoint_accepts_compose_embedding_dimension(
     monkeypatch: pytest.MonkeyPatch,
 ) -> None:
-    workspace_host = "workspace-test.cn-beijing.maas.aliyuncs.com"
     monkeypatch.setenv("EMBEDDING_DIMENSION", "1024")
-    monkeypatch.setenv(
-        "BAILIAN_OPENAI_BASE_URL",
-        f"https://{workspace_host}/compatible-mode/v1",
-    )
-    monkeypatch.setenv(
-        "BAILIAN_RERANK_BASE_URL",
-        f"https://{workspace_host}/compatible-api/v1",
-    )
     observed_dimensions: list[int] = []
 
-    def fake_api_key(settings: Settings) -> str:
-        observed_dimensions.append(settings.embedding_dimension)
-        return "test-only-api-key"
+    class StubGateway:
+        async def aclose(self) -> None:
+            return None
 
-    async def successful_probe(settings: Settings, api_key: str) -> ProbeResult:
+    def fake_gateway(settings: Settings) -> StubGateway:
         observed_dimensions.append(settings.embedding_dimension)
-        assert api_key == "test-only-api-key"
+        return StubGateway()
+
+    async def successful_probe(settings: Settings, adapter: StubGateway) -> ProbeResult:
+        observed_dimensions.append(settings.embedding_dimension)
+        assert isinstance(adapter, StubGateway)
         return ProbeResult(capability="test", status="ok")
 
-    monkeypatch.setattr(Settings, "bailian_api_key", fake_api_key)
+    monkeypatch.setattr(ModelGatewayAdapter, "from_settings", staticmethod(fake_gateway))
     monkeypatch.setattr(provider_smoke, "probe_embedding", successful_probe)
     monkeypatch.setattr(provider_smoke, "probe_rerank", successful_probe)
     monkeypatch.setattr(provider_smoke, "probe_chat", successful_probe)