Make the governed RAG evidence path executable end to end

Separate local parsing from model indexing, bind review decisions to immutable manifests, persist vectors behind active profiles, and expose retrieval, chat, evaluation, and document workflows through the React workbench.

Constraint: Live Bailian authentication currently fails for all three configured capabilities

Rejected: Direct upload-to-embedding flow | bypasses local review and manifest binding

Confidence: high

Scope-risk: broad

Directive: Keep private-data deployment blocked until authentication, RBAC, and separate database roles land

Tested: make verify; fresh and replay Docker document smoke; worker recovery smoke; frozen synthetic evaluation; migration 0003-0004 roundtrip

Not-tested: Successful live Bailian calls, OCR, real multi-user authorization

backend/tests/integration/test_schema_contract.py

@@ -35,13 +35,17 @@ def _service_block(name: str) -> str:
 def test_compose_isolates_database_credentials_and_networks() -> None:
     db = _service_block("db")
     migrate = _service_block("migrate")
+    upload_init = _service_block("upload-init")
     api = _service_block("api")
     model_gateway = _service_block("model-gateway")
+    worker_local = _service_block("worker-local")
+    worker_model = _service_block("worker-model")
     gateway = _service_block("gateway")
     web = _service_block("web")
     provider_smoke = _service_block("provider-smoke")
     seed_demo = _service_block("seed-demo")
     seed_demo_offline = _service_block("seed-demo-offline")
+    document_smoke = _service_block("document-pipeline-smoke")
 
     assert "postgres_bootstrap_password" in db
     assert "postgres_migrator_password" in db
@@ -51,11 +55,19 @@ def test_compose_isolates_database_credentials_and_networks() -> None:
     assert "postgres_bootstrap_password" not in migrate
     assert "postgres_app_password" not in migrate
 
+    assert "network_mode: none" in upload_init
+    assert 'user: "0:0"' in upload_init
+    assert "uploads_data:/data/uploads" in upload_init
+    assert "secrets:" not in upload_init
+    assert "CHOWN" in upload_init
+    assert "DAC_OVERRIDE" in upload_init
+
     assert "postgres_app_password" in api
     assert "model_gateway_api_token" in api
     assert "postgres_bootstrap_password" not in api
     assert "postgres_migrator_password" not in api
     assert "bailian_api_key" not in api
+    assert "uploads_data:/data/uploads" in api
     assert '"127.0.0.1:8000:8000"' not in api
     assert "      - data" in api
     assert "      - model" in api
@@ -69,6 +81,7 @@ def test_compose_isolates_database_credentials_and_networks() -> None:
     assert "model_gateway_api_token" in model_gateway
     assert "model_gateway_worker_token" in model_gateway
     assert "postgres_" not in model_gateway
+    assert "uploads_data" not in model_gateway
     assert "      - model" in model_gateway
     assert "      - egress" in model_gateway
     assert "      - data" not in model_gateway
@@ -79,6 +92,32 @@ def test_compose_isolates_database_credentials_and_networks() -> None:
     assert "no-new-privileges:true" in model_gateway
     assert "cap_drop:" in model_gateway and "      - ALL" in model_gateway
 
+    assert "WORKER_CAPABILITIES: document_parse" in worker_local
+    assert "postgres_app_password" in worker_local
+    assert "model_gateway_" not in worker_local
+    assert "bailian_api_key" not in worker_local
+    assert "uploads_data:/data/uploads" in worker_local
+    assert "      - data" in worker_local
+    assert "      - model" not in worker_local
+    assert "      - egress" not in worker_local
+    assert "read_only: true" in worker_local
+    assert "no-new-privileges:true" in worker_local
+    assert "stop_grace_period: 150s" in worker_local
+
+    assert "WORKER_CAPABILITIES: embedding" in worker_model
+    assert "MODEL_GATEWAY_CALLER: worker" in worker_model
+    assert "model_gateway_worker_token" in worker_model
+    assert "model_gateway_api_token" not in worker_model
+    assert "postgres_app_password" in worker_model
+    assert "bailian_api_key" not in worker_model
+    assert "uploads_data" not in worker_model
+    assert "      - data" in worker_model
+    assert "      - model" in worker_model
+    assert "      - egress" not in worker_model
+    assert "read_only: true" in worker_model
+    assert "no-new-privileges:true" in worker_model
+    assert "stop_grace_period: 150s" in worker_model
+
     assert '"127.0.0.1:8000:8000"' not in gateway
     assert "      - ingress" in gateway
     assert "      - data" in gateway
@@ -125,6 +164,18 @@ def test_compose_isolates_database_credentials_and_networks() -> None:
     assert "DEMO_PROVIDER_MODE: fake" in seed_demo_offline
     assert "./data/samples/public:/demo:ro" in seed_demo_offline
 
+    assert "secrets:" not in document_smoke
+    assert "POSTGRES_" not in document_smoke
+    assert "BAILIAN_" not in document_smoke
+    assert "model_gateway_" not in document_smoke
+    assert "DOCUMENT_NAMESPACE_MODE:" in document_smoke
+    assert "./data/samples/public:/demo:ro" in document_smoke
+    assert "      - ingress" in document_smoke
+    assert "      - data" not in document_smoke
+    assert "      - model" not in document_smoke
+    assert "      - egress" not in document_smoke
+    assert "read_only: true" in document_smoke
+
     assert re.search(r"(?ms)^  data:\n.*?^    internal: true$", COMPOSE)
     assert re.search(r"(?ms)^  ingress:\n.*?^    internal: true$", COMPOSE)
     assert re.search(r"(?ms)^  model:\n.*?^    internal: true$", COMPOSE)