Make the offline RAG chain observable without widening credential access

Expose the verified synthetic retrieval path through a typed React client and a non-root Nginx edge while keeping database credentials and data-network reachability out of the browser tier. A fixed-origin gateway preserves request boundaries and now closes upstream streams even when downstream disconnects before body iteration. The deployment ADR and runbooks record the four-network topology and its accepted Web edge-egress risk.

Constraint: The previously exposed Bailian key must be revoked and no live provider credential may enter Git, images, logs, or the browser.
Rejected: Connect Web directly to the data network | expands lateral reach to PostgreSQL.
Rejected: Publish the database-aware API on the edge network | gives a credential-bearing process a public default route.
Rejected: Buffer streaming responses in either proxy | prevents incremental chat delivery in the future.
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Do not mark Stage 1 or Stage 2 complete until the rotated-key live smoke and remaining stage gates pass.
Tested: make verify; 65 backend tests; 14 frontend tests; Docker image build; container health and isolation probes; real HTTP demo/status/search/docs/OpenAPI checks.
Not-tested: Live Bailian models, real document ingestion, business chat SSE generation, and final browser screenshot automation because the browser skill runtime was unavailable.

frontend/scripts/generate-openapi.mjs

@@ -0,0 +1,41 @@
+import { writeFile } from "node:fs/promises";
+import { resolve } from "node:path";
+
+import openapiTS, { astToString, COMMENT_HEADER } from "openapi-typescript";
+
+const schemaUrl = process.env.OPENAPI_SCHEMA_URL ?? "http://127.0.0.1:8000/openapi.json";
+const outputPath = resolve("src/api/schema.generated.ts");
+const requiredPaths = ["/api/v1/demo/status", "/api/v1/demo/search"];
+
+const response = await fetch(schemaUrl, {
+  headers: { Accept: "application/json" },
+  signal: AbortSignal.timeout(10_000),
+});
+
+if (!response.ok) {
+  throw new Error(`OpenAPI schema request failed with HTTP ${response.status}`);
+}
+
+const schema = await response.json();
+if (typeof schema !== "object" || schema === null || !("paths" in schema)) {
+  throw new Error("OpenAPI response does not contain a paths object");
+}
+
+const paths = schema.paths;
+if (typeof paths !== "object" || paths === null) {
+  throw new Error("OpenAPI paths value is invalid");
+}
+
+for (const path of requiredPaths) {
+  if (!(path in paths)) {
+    throw new Error(`Required API path is missing: ${path}`);
+  }
+}
+
+const ast = await openapiTS(schema, {
+  alphabetize: true,
+  immutable: true,
+});
+await writeFile(outputPath, `${COMMENT_HEADER}${astToString(ast)}`, "utf8");
+
+console.log(`Generated ${outputPath} from ${schemaUrl}`);