Make the governed RAG evidence path executable end to end

Separate local parsing from model indexing, bind review decisions to immutable manifests, persist vectors behind active profiles, and expose retrieval, chat, evaluation, and document workflows through the React workbench.

Constraint: Live Bailian authentication currently fails for all three configured capabilities

Rejected: Direct upload-to-embedding flow | bypasses local review and manifest binding

Confidence: high

Scope-risk: broad

Directive: Keep private-data deployment blocked until authentication, RBAC, and separate database roles land

Tested: make verify; fresh and replay Docker document smoke; worker recovery smoke; frozen synthetic evaluation; migration 0003-0004 roundtrip

Not-tested: Successful live Bailian calls, OCR, real multi-user authorization

backend/tests/integration/test_document_review_migration_contract.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[3]
+MIGRATION = (ROOT / "backend/migrations/versions/0004_document_review.py").read_text(
+    encoding="utf-8"
+)
+NORMALIZED = " ".join(MIGRATION.lower().split())
+
+
+def test_review_migration_is_additive_and_revisioned() -> None:
+    assert 'revision: str = "0004_document_review"' in MIGRATION
+    assert 'down_revision: str | none = "0003_document_ingestion"' in MIGRATION.lower()
+    assert "add column review_revision integer not null default 0" in NORMALIZED
+    assert "check (review_revision >= 0)" in NORMALIZED
+    assert "create table rag.document_review_events" in NORMALIZED
+    assert "unique (document_version_id, resulting_revision)" in NORMALIZED
+
+
+def test_review_audit_is_append_only_and_hash_bound() -> None:
+    assert "decision in ('approve', 'reject')" in NORMALIZED
+    assert "resulting_revision = previous_revision + 1" in NORMALIZED
+    assert "outbound_manifest_sha256 ~ '^[0-9a-f]{64}$'" in NORMALIZED
+    assert "embedding_profile_hash ~ '^[0-9a-f]{64}$'" in NORMALIZED
+    assert "document_review_events_append_only" in NORMALIZED
+    assert "reject_document_review_event_mutation" in NORMALIZED
+    assert "before update or delete" in NORMALIZED
+
+
+def test_review_downgrade_removes_only_review_additions() -> None:
+    assert "drop table if exists rag.document_review_events" in NORMALIZED
+    assert "drop column if exists review_revision" in NORMALIZED
+    assert "drop table if exists rag.documents" not in NORMALIZED
+    assert "drop table if exists rag.document_versions" not in NORMALIZED