Isolate cloud model access before enabling product RAG workflows

The API and ingestion tools now use a fixed internal model gateway while
governed profiles, embedding cache assignments, traceable citations, and
stable API errors establish the boundaries required by later workflows.

Constraint: The current Alibaba Cloud workspace rejects all three live model calls with authentication failures
Rejected: Give the API or seed tools the Bailian key and direct egress | combines database access, cloud credentials, and public network access
Rejected: Mix offline and Bailian vectors in one demo namespace | makes profile activation and retrieval ambiguous
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep Bailian credentials and egress exclusive to model-gateway and create a new immutable profile hash for any embedding identity change
Tested: make verify; 121 backend tests; 14 frontend tests; fresh and populated Alembic upgrade-downgrade-upgrade; two idempotent offline seeds; Docker health and HTTP retrieval; isolated provider smoke
Not-tested: Successful live Bailian responses because the supplied workspace credential currently fails authentication

compose.yaml

@@ -31,6 +31,12 @@ x-rag-config: &rag-config
   MODEL_MAX_RETRIES: "${MODEL_MAX_RETRIES:-3}"
   MODEL_MAX_CONCURRENCY: "${MODEL_MAX_CONCURRENCY:-4}"
 
+x-model-client-config: &model-client-config
+  MODEL_GATEWAY_BASE_URL: http://model-gateway:8000
+  MODEL_GATEWAY_TOKEN_FILE: /run/secrets/model_gateway_api_token
+  MODEL_GATEWAY_CALLER: api
+  MODEL_GATEWAY_TIMEOUT_SECONDS: "${MODEL_GATEWAY_TIMEOUT_SECONDS:-120}"
+
 services:
   db:
     image: pgvector/pgvector:0.8.2-pg17@sha256:feb68f4f15446397d8cac7f4fe48fe4586de83160d1fc48b46283312d1a33966
@@ -90,11 +96,53 @@ services:
         condition: service_healthy
       migrate:
         condition: service_completed_successfully
-    environment: *runtime-config
+      model-gateway:
+        condition: service_healthy
+    environment:
+      <<: [*runtime-config, *model-client-config]
     secrets:
       - postgres_app_password
+      - model_gateway_api_token
     networks:
       - data
+      - model
+    healthcheck:
+      test:
+        - CMD
+        - python
+        - -c
+        - >-
+          import urllib.request;
+          urllib.request.urlopen('http://127.0.0.1:8000/health/ready', timeout=2)
+      interval: 10s
+      timeout: 3s
+      retries: 5
+      start_period: 5s
+    init: true
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    restart: unless-stopped
+
+  model-gateway:
+    build:
+      context: ./backend
+    command: ["uvicorn", "app.model_gateway:app", "--host", "0.0.0.0", "--port", "8000"]
+    environment:
+      <<: *rag-config
+      MODEL_GATEWAY_ALLOWED_TOKEN_FILES: >-
+        api=/run/secrets/model_gateway_api_token,worker=/run/secrets/model_gateway_worker_token
+    secrets:
+      - bailian_api_key
+      - model_gateway_api_token
+      - model_gateway_worker_token
+    networks:
+      - model
+      - egress
     healthcheck:
       test:
         - CMD
@@ -187,11 +235,19 @@ services:
       context: ./backend
     command: ["python", "-m", "app.tools.provider_smoke"]
     profiles: ["tools"]
-    environment: *rag-config
+    depends_on:
+      model-gateway:
+        condition: service_healthy
+    environment:
+      <<: *model-client-config
+      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-text-embedding-v4}
+      EMBEDDING_DIMENSION: "${EMBEDDING_DIMENSION:-1024}"
+      RERANK_MODEL: ${RERANK_MODEL:-qwen3-rerank}
+      LLM_MODEL: ${LLM_MODEL:-deepseek-v4-flash}
     secrets:
-      - bailian_api_key
+      - model_gateway_api_token
     networks:
-      - egress
+      - model
     restart: "no"
 
   seed-demo:
@@ -202,17 +258,21 @@ services:
     depends_on:
       migrate:
         condition: service_completed_successfully
+      model-gateway:
+        condition: service_healthy
     environment:
-      <<: [*runtime-config, *rag-config]
+      <<: [*runtime-config, *rag-config, *model-client-config]
       DEMO_PROVIDER_MODE: bailian
       DEMO_DOCUMENTS_PATH: /demo/demo_documents.jsonl
       DEMO_QUERIES_PATH: /demo/demo_queries.jsonl
+      MODEL_GATEWAY_TOKEN_FILE: /run/secrets/model_gateway_worker_token
+      MODEL_GATEWAY_CALLER: worker
     secrets:
       - postgres_app_password
-      - bailian_api_key
+      - model_gateway_worker_token
     networks:
       - data
-      - egress
+      - model
     volumes:
       - ./data/samples/public:/demo:ro
     restart: "no"
@@ -250,6 +310,9 @@ networks:
   data:
     driver: bridge
     internal: true
+  model:
+    driver: bridge
+    internal: true
   egress:
     driver: bridge
 
@@ -260,5 +323,9 @@ secrets:
     file: ./secrets/postgres_migrator_password
   postgres_app_password:
     file: ./secrets/postgres_app_password
+  model_gateway_api_token:
+    file: ./secrets/model_gateway_api_token
+  model_gateway_worker_token:
+    file: ./secrets/model_gateway_worker_token
   bailian_api_key:
     file: ./secrets/bailian_api_key