openalice-rag

Thorough SSRF guard with DNS-pinned TOCTOU prevention, IPv4/v6 private-range blocklist (CGNAT, ULA, link-local, metadata), HTTPS-only + no-redirect fetch, credential-smuggling rejection, 8 MiB body cap, 20s timeout; GDPR Art 49 consent gate + regulated-sector US-embedder block; cargo-deny gates advisories+licenses+sources; tenant isolation via WHERE clause not Postgres RLS; no rate-limiting (library crate, delegates to openalice-axum-common)

@feature annotation on every source file; triad pattern (Chunker/Embedder/VectorStore) mirrors sister crates (llm-router, stt, tts); same TenantPolicy/Sovereignty model; cargo-deny with identical gates; #![deny(rust_2018_idioms)]; 0 circular deps; openalice-axum-common shared substrate; 2 env-drift signals (RAG_DATABASE_URL undeclared, RAG_DEFAULT_EMBEDDER/RAG_DEFAULT_K declared-unused)

~90 tests across src/tests.rs (unit) + tests/router_test.rs (integration) + inline module tests; covers SSRF edge cases (20+ IP range/URL-shape tests), all 3 chunkers, InMemoryStore tenant isolation/upsert idempotency/cosine ordering/k-limit, policy enforcement (consent/sector/allow-list), error retryability matrix, vector-count-mismatch and dimension-mismatch guards, HtmlChunker regex-cache regression; CI present but currently red (failure on 2026-06-19)

20s fetch timeout + streaming body cap enforce resource bounds; is_retryable() classifies 5xx/408/425/429 as retryable with clear non-retryable policy errors; vector-count-mismatch and dimension-mismatch guards prevent silent data corruption; idempotent upsert; no in-crate retry/backoff or circuit breaker (openalice-axum-common dep suggests delegation); graceful shutdown N/A for library crate

Single migration with pgvector extension, tenant_id btree index for pre-ANN pruning, document_id index, ivfflat ANN index; idempotent ON CONFLICT upsert; GDPR Art 17 delete_tenant erasure primitive; but no FK constraints (document_id is free text), no RLS (app-level WHERE only), no updated_at column, schema is minimal for a production store

#[instrument] spans on index/retrieve/retrieve_scoped/purge_source/purge_tenant/ingest_url; structured CostEvent with tenant/embedder/model/tokens/cost/latency emitted per embed call; LoggingTracker INFO sink; but no Prometheus metrics or counters, no health probes (library — no endpoint exposed per Atlas), tracing present in only 5 of 22 source files