[Sebastiangmz]

Summary

Milestone 0 baseline/governance for CodeRAG modernization.

This PR establishes the project as a safer, evidence-backed baseline before feature-heavy work toward the "verified codebase context engine" roadmap.

Changes

• Added CodeRAG 2.0 roadmap and Milestone 0 contract under docs/superpowers/plans/.
• Aligned runtime/config/docs versioning to 0.1.2.
• Changed default server posture to loopback-first:
  • 127.0.0.1 default bind
  • explicit loopback CORS origins
  • no wildcard credentialed CORS default
• Disabled remote model code execution by default via ModelSettings.allow_remote_code = False.
• Updated README, .env.example, default configs, and Docker host exposure to match safe defaults.
• Added targeted Milestone 0 tests in tests/test_m0_baseline.py.
• Added committed EvalFly smoke config and CI-compatible runner scripts/evalfly_smoke.py.
• Added GitHub Actions CI for the Milestone 0 gate.
• Recorded SpecSafe/EvalFly evidence for completed slices.
• Ignored local agent audit logs: .pi/.push-log.jsonl, .pi/.github-log.jsonl.

Evidence

Fresh local verification before opening this PR:

• PYTHONPATH=src .venv/bin/python -m pytest tests/test_m0_baseline.py
  • 10 passed, 1 warning
  • warning is existing local env warning: PytestConfigWarning: Unknown config option: asyncio_mode
• .venv/bin/python -m ruff check tests/test_m0_baseline.py scripts/evalfly_smoke.py
  • OK
• PYTHONPATH=src .venv/bin/python -m mypy tests/test_m0_baseline.py scripts/evalfly_smoke.py
  • OK
• .venv/bin/python scripts/evalfly_smoke.py --suite smoke
  • evalfly committed smoke passed: 4 cases
• .venv/bin/python -m py_compile src/coderag/__init__.py src/coderag/config.py src/coderag/main.py src/coderag/cli.py src/coderag/indexing/embeddings.py src/coderag/generation/generator.py tests/test_m0_baseline.py scripts/evalfly_smoke.py
  • exit 0, no output
• .venv/bin/python -m build
  • built code_rag_me-0.1.2.tar.gz
  • built code_rag_me-0.1.2-py3-none-any.whl

Prior recorded evidence:

• EvalFly report: evals/reports/run-smoke-20260627203451.md
  • suite: smoke
  • verdict: pass
  • passed: 4
  • failed: 0
  • critical regressions: 0
• Reviewer pass after fixes:
  • RvContext2: PASS
  • RvSecurity2: PASS
  • RvQuality2: PASS

Scope notes

This is not a production-ready product release. It intentionally does not implement:

• verified citation engine
• hybrid retrieval
• SQLite registry
• code graph
• full project-wide lint/typecheck remediation

Those belong to later milestones after the baseline/governance harness is merged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.