Prepare BrainAPI 2.17.0rc1 for production

[ChrisCoder9000]

Summary

• restore deterministic Python, benchmark, Console, TUI, and Rust validation
• harden authentication, CORS, plugin loading, Docker images, nginx, and both Compose profiles
• add profile-aware backup, verification, and restore tooling
• replace release automation with exact-image RC gates, SBOM/security evidence, and dedicated heavy-runner validation
• add representative search evaluation and label recommendations Preview
• prepare package metadata for 2.17.0rc1

Local validation

• Python: 578 passed, 2 skipped, 16 subtests
• benchmark helpers: 38 passed
• Console build: passed
• TUI typecheck/build: passed
• Rust cargo test --locked: passed
• Poetry and uv lock checks: passed
• Python and npm runtime audits: no high/critical advisories

Release constraints

The RC tag must only be created from merged main after required GitHub checks pass. The exact candidate image must pass light and heavy smoke/restore/security validation. The representative LongMemEval ledger entry remains a release gate.

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 158 files, which is 58 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 43bf20be-b604-42a5-81f5-41c8fec03ddf

📥 Commits

Reviewing files that changed from the base of the PR and between c4f9cfb and 98a8720.

⛔ Files ignored due to path filters (4)

• console/package-lock.json is excluded by !**/package-lock.json
• mcp-stdio-http-bridge/Cargo.lock is excluded by !**/*.lock
• poetry.lock is excluded by !**/*.lock
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (158)

• .env.example
• .github/workflows/deploy.yaml
• .github/workflows/heavy-validation.yaml
• .github/workflows/quality.yaml
• .github/workflows/release.yaml
• .github/workflows/staging.yaml
• .github/workflows/tags.yaml
• Dockerfile
• README.md
• benchmarks/.env.example
• benchmarks/AGENTS.md
• benchmarks/README.md
• benchmarks/REPORTS.json
• benchmarks/requirements.txt
• benchmarks/search.sh
• benchmarks/search/__init__.py
• benchmarks/search/__main__.py
• benchmarks/search/backfill_entities.py
• benchmarks/search/catalog.py
• benchmarks/search/cli.py
• benchmarks/search/client.py
• benchmarks/search/config.py
• benchmarks/search/dataset.py
• benchmarks/search/evaluate.py
• benchmarks/search/export_hybrid_lists.py
• benchmarks/search/finetune_esci_4class.py
• benchmarks/search/finetune_esci_ce.py
• benchmarks/search/finetune_esci_dense.py
• benchmarks/search/jdsearch.py
• benchmarks/search/jdsearch_stats.py
• benchmarks/search/list_overlap.py
• benchmarks/search/local_colbert.py
• benchmarks/search/local_dense.py
• benchmarks/search/ltr_head.py
• benchmarks/search/mapping.py
• benchmarks/search/metrics.py
• benchmarks/search/mine_retrieved_lists.py
• benchmarks/search/miss.py
• benchmarks/search/miss_strata.py
• benchmarks/search/pool_first_stage.py
• benchmarks/search/rank_corpus.py
• benchmarks/search/rank_pool.py
• benchmarks/search/rank_pool_4class.py
• benchmarks/search/replay_fusion.py
• benchmarks/search/report.py
• benchmarks/search/rerank_retrieved.py
• console/package.json
• deploy/README.md
• deploy/backup_restore.py
• deploy/brainapi-backup
• deploy/docker-compose.ci.yaml
• deploy/docker-compose.heavy.yaml
• deploy/docker-compose.light.yaml
• deploy/env.heavy.example
• deploy/env.light.example
• deploy/env.public-demo.example
• deploy/nginx/conf.d/brainapi.conf
• deploy/nginx/nginx.conf
• deploy/release-artifacts/README.md
• docs/decisions/007-three-product-surfaces-one-kb.md
• docs/decisions/008-query-gated-search-personalization.md
• docs/research/00-scope-and-constraints.md
• docs/research/16-recsys-eval-protocol.md
• docs/research/17-search-surface-and-cross-features.md
• docs/research/18-search-eval-protocol.md
• docs/research/19-search-esci-quality.md
• docs/research/20-esci-sota-targets.md
• docs/research/21-esci-ce-graded-and-first-stage.md
• docs/research/22-multilingual-ecommerce-search.md
• docs/research/23-search-wands-quality.md
• docs/research/24-search-catalog-graph.md
• docs/research/25-personalized-search.md
• entrypoint.sh
• pyproject.toml
• scripts/assemble_release_artifacts.py
• scripts/check_release_readiness.py
• scripts/openai_ci_stub.py
• scripts/production_smoke.py
• scripts/seed_public_demo.py
• scripts/write_security_artifact.py
• src/adapters/data.py
• src/adapters/graph.py
• src/adapters/interfaces/data.py
• src/config.py
• src/constants/tasks/ingestion.py
• src/core/agents/architect_agent.py
• src/core/plugins/celery_discovery.py
• src/core/plugins/context.py
• src/core/plugins/loader.py
• src/core/saving/ingestion_manager.py
• src/core/search/bm25.py
• src/core/search/catalog_graph.py
• src/core/search/entity_info.py
• src/core/search/graph_channels.py
• src/core/search/hooks.py
• src/core/search/hybrid.py
• src/core/search/personalize.py
• src/core/search/recommend.py
• src/lib/postgresql/data.py
• src/lib/postgresql/graph_store.py
• src/lib/postgresql/networkx_client.py
• src/lib/postgresql/vectors.py
• src/lib/redis/client.py
• src/services/api/app.py
• src/services/api/constants/requests.py
• src/services/api/constants/responses.py
• src/services/api/controllers/entities.py
• src/services/api/controllers/retrieve.py
• src/services/api/controllers/search.py
• src/services/api/errors.py
• src/services/api/middlewares/auth.py
• src/services/api/middlewares/brains.py
• src/services/api/openapi.py
• src/services/api/routes/ingest.py
• src/services/api/routes/meta.py
• src/services/api/routes/model.py
• src/services/api/routes/public.py
• src/services/api/routes/retrieve.py
• src/services/api/routes/system.py
• src/services/api/routes/tasks.py
• src/services/mcp/app.py
• src/workers/app.py
• src/workers/redis_url.py
• src/workers/tasks/ingestion.py
• tests/conftest.py
• tests/fixtures/jdsearch/product_meta_data.txt
• tests/fixtures/jdsearch/user_behavior_data.txt
• tests/plugins_path_helper.py
• tests/test_agent_readiness_api.py
• tests/test_benchmark_contract_guardrails.py
• tests/test_catalog_graph_search.py
• tests/test_chatbot_inference_plugin.py
• tests/test_context_retrieval.py
• tests/test_deploy_production_contract.py
• tests/test_halfvec_ann.py
• tests/test_ingestion_standard.py
• tests/test_ingestion_structured_contract.py
• tests/test_production_hardening.py
• tests/test_recommend_recsys.py
• tests/test_recsys_lightgcn.py
• tests/test_search_api.py
• tests/test_search_bench.py
• tests/test_search_bm25.py
• tests/test_search_catalog.py
• tests/test_search_config.py
• tests/test_search_esci_4class.py
• tests/test_search_graph.py
• tests/test_search_jdsearch.py
• tests/test_search_personalize.py
• tests/test_search_plugins.py
• tests/test_structured_triple_persistence.py
• tui/README.md
• tui/src/commands/config.ts
• tui/src/constants.ts
• tui/src/flows/search.ts
• tui/src/flows/setup-wizard.ts
• tui/src/lib/write-env.ts
• tui/src/types.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ChrisCoder9000]

Hosted validation is green for commit 98a87202c625ff3b456730b8ccd990c872f1d8c4:

• Python: 578 passed, 2 skipped
• benchmark helper suite: passed
• Console and TUI builds: passed
• Rust locked tests: passed
• exact candidate image build, SBOM, and high/critical vulnerability gate: passed
• light-profile smoke plus backup/clean restore: passed

Release blockers still open:

• heavy-smoke-and-restore is queued only for [self-hosted, linux, x64, brainapi-heavy]; it will not run on GitHub-hosted infrastructure. Attach the supplied >=16 GB Linux x64 VM with that label to continue.
• A representative LongMemEval result (>=50 scored questions) must be recorded in benchmarks/REPORTS.json.

The RC tag v2.17.0-rc.1 remains intentionally uncreated until these gates pass; the release workflow also enforces that the tagged commit is on main and has successful light/heavy checks.