Make the first RAG slice executable without risking production data

The Stage 1 foundation now proves provider contracts with mocks and validates PostgreSQL/pgvector ingestion, approval binding, retrieval, reranking, and idempotency using only synthetic data. Live Bailian validation remains gated on rotating the exposed key.

Constraint: The key shown in chat is compromised and cannot be used or committed

Rejected: Mark Stage 1 complete from mock and offline results | real three-model smoke is still required

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Do not enable real-data ingestion until Stage 3 cloud approval and outbound manifest controls are enforced end to end

Tested: make verify; 41 pytest tests; strict mypy; Ruff; Compose config; pinned image build; empty-volume migration; role denial; two idempotent 20-vector seeds; database restart persistence

Not-tested: Live Bailian calls require a newly rotated key; React product UI is not implemented

backend/tests/unit/test_secret_scanner.py

@@ -0,0 +1,38 @@
+import subprocess
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parents[3]
+SCANNER = PROJECT_ROOT / "scripts" / "check-secrets.sh"
+
+
+def run_git(repository: Path, *arguments: str) -> None:
+    subprocess.run(
+        ["git", *arguments],
+        cwd=repository,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+
+
+def test_staged_scan_reads_index_blob_not_modified_worktree(tmp_path: Path) -> None:
+    run_git(tmp_path, "init", "--quiet")
+    run_git(tmp_path, "config", "user.email", "test@example.invalid")
+    run_git(tmp_path, "config", "user.name", "Secret Scanner Test")
+    candidate = tmp_path / "config.txt"
+    candidate.write_text("sk-" + "A" * 30, encoding="utf-8")
+    run_git(tmp_path, "add", "config.txt")
+    candidate.write_text("safe working-tree replacement", encoding="utf-8")
+
+    result = subprocess.run(
+        [str(SCANNER), "--staged"],
+        cwd=tmp_path,
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+
+    assert result.returncode == 1
+    assert "config.txt" in result.stderr
+    assert "safe working-tree replacement" not in result.stderr
+    assert "A" * 30 not in result.stderr