Make the first RAG slice executable without risking production data

The Stage 1 foundation now proves provider contracts with mocks and validates PostgreSQL/pgvector ingestion, approval binding, retrieval, reranking, and idempotency using only synthetic data. Live Bailian validation remains gated on rotating the exposed key.

Constraint: The key shown in chat is compromised and cannot be used or committed

Rejected: Mark Stage 1 complete from mock and offline results | real three-model smoke is still required

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: Do not enable real-data ingestion until Stage 3 cloud approval and outbound manifest controls are enforced end to end

Tested: make verify; 41 pytest tests; strict mypy; Ruff; Compose config; pinned image build; empty-volume migration; role denial; two idempotent 20-vector seeds; database restart persistence

Not-tested: Live Bailian calls require a newly rotated key; React product UI is not implemented

compose.yaml

@@ -0,0 +1,160 @@
+name: geological-rag
+
+x-runtime-config: &runtime-config
+  APP_ENV: ${APP_ENV:-development}
+  APP_NAME: ${APP_NAME:-geological-rag}
+  POSTGRES_HOST: db
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: ${POSTGRES_DB:-geological_rag}
+  POSTGRES_USER: ${POSTGRES_APP_USER:-geological_rag_app}
+  POSTGRES_PASSWORD_FILE: /run/secrets/postgres_app_password
+  UPLOAD_ROOT: ${UPLOAD_ROOT:-/data/uploads}
+  MAX_UPLOAD_MB: "${MAX_UPLOAD_MB:-100}"
+
+x-rag-config: &rag-config
+  DASHSCOPE_API_KEY_FILE: /run/secrets/bailian_api_key
+  BAILIAN_OPENAI_BASE_URL: "${BAILIAN_OPENAI_BASE_URL:-}"
+  BAILIAN_NATIVE_BASE_URL: "${BAILIAN_NATIVE_BASE_URL:-}"
+  BAILIAN_RERANK_BASE_URL: "${BAILIAN_RERANK_BASE_URL:-}"
+  EMBEDDING_MODEL: ${EMBEDDING_MODEL:-text-embedding-v4}
+  EMBEDDING_DIMENSION: "${EMBEDDING_DIMENSION:-1024}"
+  RERANK_MODEL: ${RERANK_MODEL:-qwen3-rerank}
+  LLM_MODEL: ${LLM_MODEL:-deepseek-v4-flash}
+  CHUNK_TARGET_TOKENS: "${CHUNK_TARGET_TOKENS:-512}"
+  CHUNK_MAX_TOKENS: "${CHUNK_MAX_TOKENS:-800}"
+  CHUNK_OVERLAP_TOKENS: "${CHUNK_OVERLAP_TOKENS:-64}"
+  VECTOR_TOP_K: "${VECTOR_TOP_K:-50}"
+  RERANK_TOP_N: "${RERANK_TOP_N:-10}"
+  CONTEXT_TOP_N: "${CONTEXT_TOP_N:-8}"
+  MAX_CONTEXT_TOKENS: "${MAX_CONTEXT_TOKENS:-10000}"
+  MODEL_TIMEOUT_SECONDS: "${MODEL_TIMEOUT_SECONDS:-90}"
+  MODEL_MAX_RETRIES: "${MODEL_MAX_RETRIES:-3}"
+  MODEL_MAX_CONCURRENCY: "${MODEL_MAX_CONCURRENCY:-4}"
+
+services:
+  db:
+    image: pgvector/pgvector:0.8.2-pg17@sha256:feb68f4f15446397d8cac7f4fe48fe4586de83160d1fc48b46283312d1a33966
+    environment:
+      POSTGRES_DB: ${POSTGRES_DB:-geological_rag}
+      POSTGRES_USER: ${POSTGRES_BOOTSTRAP_USER:-postgres}
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_bootstrap_password
+      POSTGRES_MIGRATOR_USER: ${POSTGRES_MIGRATOR_USER:-geological_rag_migrator}
+      POSTGRES_MIGRATOR_PASSWORD_FILE: /run/secrets/postgres_migrator_password
+      POSTGRES_APP_USER: ${POSTGRES_APP_USER:-geological_rag_app}
+      POSTGRES_APP_PASSWORD_FILE: /run/secrets/postgres_app_password
+    secrets:
+      - postgres_bootstrap_password
+      - postgres_migrator_password
+      - postgres_app_password
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./ops/postgres/init:/docker-entrypoint-initdb.d:ro
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          pg_isready -h 127.0.0.1 -p 5432 -U $$POSTGRES_USER -d $$POSTGRES_DB
+          && test -f $$PGDATA/.rag-bootstrap-complete
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    networks:
+      - data
+    restart: unless-stopped
+
+  migrate:
+    build:
+      context: ./backend
+    command: ["alembic", "upgrade", "head"]
+    depends_on:
+      db:
+        condition: service_healthy
+    environment:
+      POSTGRES_HOST: db
+      POSTGRES_PORT: "5432"
+      POSTGRES_DB: ${POSTGRES_DB:-geological_rag}
+      POSTGRES_USER: ${POSTGRES_MIGRATOR_USER:-geological_rag_migrator}
+      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_migrator_password
+    secrets:
+      - postgres_migrator_password
+    networks:
+      - data
+    restart: "no"
+
+  provider-smoke:
+    build:
+      context: ./backend
+    command: ["python", "-m", "app.tools.provider_smoke"]
+    profiles: ["tools"]
+    environment: *rag-config
+    secrets:
+      - bailian_api_key
+    networks:
+      - egress
+    restart: "no"
+
+  seed-demo:
+    build:
+      context: ./backend
+    command: ["python", "-m", "app.tools.seed_demo"]
+    profiles: ["tools"]
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    environment:
+      <<: [*runtime-config, *rag-config]
+      DEMO_PROVIDER_MODE: bailian
+      DEMO_DOCUMENTS_PATH: /demo/demo_documents.jsonl
+      DEMO_QUERIES_PATH: /demo/demo_queries.jsonl
+    secrets:
+      - postgres_app_password
+      - bailian_api_key
+    networks:
+      - data
+      - egress
+    volumes:
+      - ./data/samples/public:/demo:ro
+    restart: "no"
+
+  seed-demo-offline:
+    build:
+      context: ./backend
+    command: ["python", "-m", "app.tools.seed_demo"]
+    profiles: ["tools"]
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    environment:
+      <<: *runtime-config
+      DEMO_PROVIDER_MODE: fake
+      DEMO_DOCUMENTS_PATH: /demo/demo_documents.jsonl
+      DEMO_QUERIES_PATH: /demo/demo_queries.jsonl
+    secrets:
+      - postgres_app_password
+    networks:
+      - data
+    volumes:
+      - ./data/samples/public:/demo:ro
+    restart: "no"
+
+volumes:
+  postgres_data:
+
+networks:
+  edge:
+    driver: bridge
+  data:
+    driver: bridge
+    internal: true
+  egress:
+    driver: bridge
+
+secrets:
+  postgres_bootstrap_password:
+    file: ./secrets/postgres_bootstrap_password
+  postgres_migrator_password:
+    file: ./secrets/postgres_migrator_password
+  postgres_app_password:
+    file: ./secrets/postgres_app_password
+  bailian_api_key:
+    file: ./secrets/bailian_api_key