Milestone 0: baseline governance harness

.env.example

@@ -14,16 +14,20 @@
 # =============================================================================
 DEBUG=false
 APP_NAME=CodeRAG
-APP_VERSION=0.1.0
+APP_VERSION=0.1.2
 
 # =============================================================================
 # Server Settings
 # =============================================================================
-SERVER_HOST=0.0.0.0
+SERVER_HOST=127.0.0.1
 SERVER_PORT=8000
 SERVER_LOG_LEVEL=info
 SERVER_WORKERS=1
 SERVER_RELOAD=false
+# CORS defaults trust only loopback browser origins.
+# Use JSON list syntax when overriding through environment variables.
+SERVER_CORS_ALLOWED_ORIGINS='["http://127.0.0.1:8000","http://localhost:8000"]'
+SERVER_CORS_ALLOW_CREDENTIALS=true
 
 # =============================================================================
 # Model Settings
@@ -51,6 +55,9 @@ MODEL_LLM_API_BASE=
 # For local: Qwen/Qwen2.5-Coder-3B-Instruct (requires GPU with 8GB VRAM)
 MODEL_LLM_NAME=llama-3.3-70b-versatile
 MODEL_LLM_MAX_NEW_TOKENS=1024
+# Remote model repository code execution is disabled by default.
+# Set true only after reviewing and pinning the model source.
+MODEL_ALLOW_REMOTE_CODE=false
 MODEL_LLM_TEMPERATURE=0.1
 MODEL_LLM_TOP_P=0.95
 MODEL_LLM_USE_4BIT=true

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  validate:
+    name: Validate package
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install baseline validation tools
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install build
+          python -m pip install -e . --no-deps
+          python -m pip install pytest pydantic pydantic-settings click PyYAML fastapi structlog ruff mypy
+
+      - name: Run Milestone 0 tests
+        run: PYTHONPATH=src python -m pytest tests/test_m0_baseline.py
+
+      - name: Run Milestone 0 lint baseline
+        run: ruff check tests/test_m0_baseline.py scripts/evalfly_smoke.py
+
+      - name: Run Milestone 0 type baseline
+        run: PYTHONPATH=src mypy tests/test_m0_baseline.py scripts/evalfly_smoke.py
+
+      - name: Compile changed runtime modules
+        run: python -m py_compile src/coderag/__init__.py src/coderag/config.py src/coderag/main.py src/coderag/cli.py src/coderag/indexing/embeddings.py src/coderag/generation/generator.py tests/test_m0_baseline.py scripts/evalfly_smoke.py
+
+      - name: Build package
+        run: python -m build
+
+      - name: Run committed EvalFly smoke baseline
+        run: python scripts/evalfly_smoke.py --suite smoke

.gitignore

@@ -165,3 +165,10 @@ specs/
 AGENTS.md
 CLAUDE.md
 QWEN.md
+
+
+# =============================================================================
+# Local AI Agent Audit Logs
+# =============================================================================
+.pi/.push-log.jsonl
+.pi/.github-log.jsonl

.pi/.specsafe-state.json

@@ -0,0 +1,65 @@
+{
+  "currentSlice": null,
+  "history": [
+    {
+      "sliceId": "CRAG-20260627-ROADMAP",
+      "workspaceId": "CodeRAG",
+      "sessionId": "omp-session",
+      "beganAt": "2026-06-27T19:59:14.649Z",
+      "endedAt": "2026-06-27T20:08:58.201Z",
+      "outcome": "PASS",
+      "costSummary": {
+        "externalMemoryCalls": 0,
+        "externalMemoryCost": 0,
+        "subagentTokens": {
+          "input": 0,
+          "output": 0,
+          "cacheRead": 0,
+          "cacheWrite": 0,
+          "cost": 0,
+          "turns": 0
+        }
+      }
+    },
+    {
+      "sliceId": "CRAG-20260627-M0-BASELINE",
+      "workspaceId": "CodeRAG",
+      "sessionId": "omp-session",
+      "beganAt": "2026-06-27T20:18:54.230Z",
+      "endedAt": "2026-06-27T20:24:37.068Z",
+      "outcome": "PASS",
+      "costSummary": {
+        "externalMemoryCalls": 0,
+        "externalMemoryCost": 0,
+        "subagentTokens": {
+          "input": 0,
+          "output": 0,
+          "cacheRead": 0,
+          "cacheWrite": 0,
+          "cost": 0,
+          "turns": 0
+        }
+      }
+    },
+    {
+      "sliceId": "CRAG-20260627-M0-REVIEW-FIXES",
+      "workspaceId": "CodeRAG",
+      "sessionId": "omp-session",
+      "beganAt": "2026-06-27T20:34:36.861Z",
+      "endedAt": "2026-06-27T20:39:34.398Z",
+      "outcome": "PASS",
+      "costSummary": {
+        "externalMemoryCalls": 0,
+        "externalMemoryCost": 0,
+        "subagentTokens": {
+          "input": 0,
+          "output": 0,
+          "cacheRead": 0,
+          "cacheWrite": 0,
+          "cost": 0,
+          "turns": 0
+        }
+      }
+    }
+  ]
+}

README.md

@@ -278,9 +278,12 @@ MODEL_LLM_API_KEY=your-api-key
 # Embeddings (runs locally on CPU by default)
 MODEL_EMBEDDING_DEVICE=auto  # auto, cuda, or cpu
 
-# Server
-SERVER_HOST=0.0.0.0
+# Server defaults to loopback for local safety.
+SERVER_HOST=127.0.0.1
 SERVER_PORT=8000
+
+# Bind to 0.0.0.0 only as an explicit deployment override
+# after configuring trusted CORS origins and network access controls.
 ```
 
 ### Config File

configs/default.yaml

@@ -3,16 +3,20 @@
 
 app:
   name: CodeRAG
-  version: 0.1.0
+  version: 0.1.2
   debug: false
 
 server:
-  host: 0.0.0.0
+  host: 127.0.0.1
   port: 8000
   reload: false
   workers: 1
   log_level: info
 
+  cors_allowed_origins:
+    - http://127.0.0.1:8000
+    - http://localhost:8000
+  cors_allow_credentials: true
 data:
   base_dir: ./data
   repos_cache: ./data/repos

configs/models.yaml

@@ -18,7 +18,7 @@ llm:
 
   # Device settings
   device_map: auto
-  trust_remote_code: true
+  trust_remote_code: false
 
   # Fallback model for constrained environments
   fallback:

docker-compose.yaml

@@ -19,7 +19,8 @@ services:
               capabilities: [gpu]
 
     ports:
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
+      # The container still binds internally; host exposure stays loopback by default.
 
     environment:
       - DEBUG=false