Prepare Vectorless RAG v0.2.0 research preview

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,65 @@
+name: Bug report
+description: Report a reproducible defect in Vectorless RAG.
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Remove API keys, provider prompts, document text, and other secrets before submitting.
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Provide the v0.2.x version or full commit SHA.
+      placeholder: v0.2.0
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Surface
+      options:
+        - API or worker
+        - Operator console
+        - Docker Compose
+        - Helm
+        - Documentation
+        - Evaluation
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: List the smallest provider-safe steps that reproduce the defect.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: diagnostics
+    attributes:
+      label: Sanitized diagnostics
+      description: Include relevant logs or command output after removing secrets and document content.
+      render: shell
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Submission checks
+      options:
+        - label: I searched existing issues and Discussions.
+          required: true
+        - label: I removed credentials, private documents, prompts, and provider response bodies.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and operator support
+    url: https://github.com/ProofOfTechOrg/vectorless-rag/discussions
+    about: Ask usage and troubleshooting questions in Discussions.
+  - name: Report a security vulnerability
+    url: https://github.com/ProofOfTechOrg/vectorless-rag/security/advisories/new
+    about: Send sensitive security reports through a private advisory.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: Feature request
+description: Propose a scoped change to Vectorless RAG.
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the operator or research problem without prescribing an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Desired outcome
+      description: State the observable result and who benefits.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: List existing commands, workflows, or external tools you evaluated.
+  - type: textarea
+    id: constraints
+    attributes:
+      label: Security and provider-cost impact
+      description: Note any credential, document-data, model-call, or deployment implications.
+    validations:
+      required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+<!-- Content type: Reference -->
+<!-- Content plan: Goal: collect the evidence needed to review a change. Audience: contributors and maintainers. Content: scope, verification, security, documentation, and AI-use disclosure. Open questions: none. -->
+
+## Change
+
+Describe the problem, the implemented change, and deliberate exclusions.
+
+## Verification
+
+List each command you ran and its result.
+
+- [ ] Tests cover the changed behavior
+- [ ] Documentation matches the changed behavior
+- [ ] No API key, provider prompt, document text, or other secret appears in the diff or test artifacts
+- [ ] Provider-backed tests and their cost were explicitly authorized, or this change used only provider-free tests
+
+## AI-use disclosure
+
+Name any AI tool used, the work it performed, and the review you completed. Write “None” if no AI tool contributed.

.github/workflows/ci.yml

@@ -3,25 +3,29 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   api:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.3.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with: {version: "0.11.29", enable-cache: true}
       - run: make api-install
       - run: make api-lint
       - run: make api-typecheck
       - run: make api-test
       - run: make migration-check
+      - run: make test-integration-stack
 
   web:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with: {node-version: 22, cache: pnpm}
       - run: make web-install
       - run: make playwright-install
@@ -38,11 +42,13 @@ jobs:
   deployment:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.3.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with: {version: "0.11.29"}
-      - uses: azure/setup-helm@v5
+      - uses: Azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
+        with: {version: "v4.2.3"}
       - run: make api-install
+      - run: make docs-check
       - run: make workflow-check
       - run: make compose-check ENV_FILE=.env.example
       - run: make helm-check

CHANGELOG.md

@@ -0,0 +1,32 @@
+<!-- Content type: Reference -->
+<!-- Content plan: Goal: record user-visible release changes and research-preview limits. Audience: users, operators, and maintainers. Content: unreleased changes and dated releases. Open questions: none. -->
+
+# Track Vectorless RAG releases
+
+This changelog records user-visible changes. Vectorless RAG follows semantic version labels, but prerelease status does not promise production stability.
+
+## Unreleased
+
+No user-visible changes have been recorded after v0.2.0.
+
+## 0.2.0, 2026-07-27
+
+Version 0.2.0 publishes the repository under the MIT License as a source-only research preview.
+
+### Added
+
+- TanStack Start operator console for chat, documents, ingestion, settings, scoped connection, appearance, and logout
+- Encrypted HttpOnly browser session backed by FastAPI API-key validation
+- Durable PDF ingestion, PageIndex v2 artifacts, catalog routing, page citations, usage accounting, and provider-state handling
+- Docker Compose and Helm deployment surfaces
+- Deterministic API, PostgreSQL integration, browser, deployment, image, and evaluation checks
+- Atomic local environment initialization and indexed public documentation
+
+### Research-preview limitations
+
+- The default gate permits 25 registered documents and keeps full-corpus ingestion disabled
+- The frozen pilot has a $10 provider-cost ceiling
+- DeepSeek-backed ingestion and chat incur external provider cost
+- Optical character recognition, API-key lifecycle management, and an embedded PDF viewer are unavailable
+- Full 537-document ingestion and a final vector-versus-PageIndex quality verdict remain outside this release
+- The release contains source archives only

CODE_OF_CONDUCT.md

@@ -0,0 +1,84 @@
+<!-- Content type: Reference -->
+<!-- Content plan: Goal: define participation standards and enforcement for project spaces. Audience: contributors, maintainers, and community members. Content: Contributor Covenant 2.1 standards, enforcement, and reporting. Open questions: none. -->
+
+# Contributor Covenant Code of Conduct
+
+This policy adopts Contributor Covenant version 2.1 for all Vectorless RAG community spaces.
+
+## Our pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socioeconomic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+- Demonstrating empathy and kindness toward other people
+- Respecting differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+- Focusing on what is best not only for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others’ private information, such as a physical or email address, without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior. They will take appropriate and fair corrective action in response to behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that do not align with this Code of Conduct. They will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces. It also applies when an individual officially represents the community in public spaces.
+
+Examples of representing our community include using an official email address, posting through an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Report abusive, harassing, or otherwise unacceptable behavior privately to [hello@proofoftech.org](mailto:hello@proofoftech.org). Community leaders will review and investigate complaints promptly and fairly.
+
+Community leaders must respect the privacy and security of anyone who reports an incident.
+
+## Enforcement guidelines
+
+Community leaders will follow these Community Impact Guidelines when determining the consequences for any action they deem in violation of this Code of Conduct.
+
+### 1. Correction
+
+**Community impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders that explains the violation and the nature of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. The person must not interact with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This restriction includes avoiding interactions in community spaces and external channels such as social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary ban
+
+**Community impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any interaction or public communication with the community for a specified period. The person must not interact publicly or privately with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent ban
+
+**Community impact**: A pattern of violating community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
+
+Community Impact Guidelines were inspired by [Mozilla’s code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+For answers to common questions about this code of conduct, see the [Contributor Covenant frequently asked questions](https://www.contributor-covenant.org/faq). Translations are available from the [Contributor Covenant translations index](https://www.contributor-covenant.org/translations).

CONTRIBUTING.md

@@ -0,0 +1,75 @@
+<!-- Content type: How-to -->
+<!-- Content plan: Goal: prepare a reviewable contribution that preserves project safety and verification contracts. Audience: external contributors and maintainers. Content: setup, workflow, tests, documentation, security, cost, and AI disclosure. Open questions: none. -->
+
+# Contribute to Vectorless RAG
+
+This guide explains how to prepare, verify, and submit a change to the research preview. Keep each pull request focused on one defect, feature, or documentation outcome.
+
+## Prepare the development environment
+
+You need Python 3.12, `uv`, Node.js 22, pnpm, Docker Compose 2.22 or later, GNU Make, and Helm 4.2.3.
+
+Clone your fork and install the frozen dependency graphs:
+
+```bash
+git clone https://github.com/your_github_name/vectorless-rag.git
+cd vectorless-rag
+make install
+```
+
+The repository quarantines newly published dependencies for seven days through pnpm and uv configuration. Do not remove or bypass those settings to resolve an install failure.
+
+Run `make init` only when you need a local live stack. The command refuses to replace an existing `.env`.
+
+## Develop on a focused branch
+
+Create a branch from current `master`:
+
+```bash
+git fetch origin
+git switch master
+git pull --ff-only
+git switch -c fix/describe-the-defect
+```
+
+Match the surrounding code style. Fix the root cause and every code path with the same defect. Avoid unrelated formatting, new abstractions, and dependency changes.
+
+## Verify the affected surfaces
+
+Run the smallest relevant command while developing, then run the complete provider-free gates before opening a pull request:
+
+```bash
+make docs-check
+make api-check
+make test-integration-stack
+make web-check
+make playwright
+make deploy-check ENV_FILE=.env.example
+```
+
+Changes to images or release behavior also require `make docker-build`. See [choose a test tier](docs/testing.md) for prerequisites and expected results.
+
+Do not use DeepSeek credentials in continuous integration (CI). Do not run provider-backed tests unless you have explicit cost authorization.
+
+## Document behavior and decisions
+
+Update user documentation in the same pull request as the behavior change. Add a content-type and content-plan comment to every new Markdown page, use sentence-case headings, tag code fences, and add the page to `docs/README.md`.
+
+Record user-visible changes under `Unreleased` in `CHANGELOG.md`. Preserve dated design records instead of rewriting their historical measurements with current assumptions.
+
+## Protect credentials and research data
+
+Never commit or post:
+
+- API keys, session secrets, database passwords, or provider credentials
+- Provider prompts, response bodies, or private document text
+- Playwright traces, screenshots, videos, or storage state from credentialed tests
+- Files from the Git-ignored `arxiv-pdfs` corpus
+
+Use sanitized diagnostics in issues and pull requests. Report exploitable security defects through the [private vulnerability reporting channel](https://github.com/ProofOfTechOrg/vectorless-rag/security/advisories/new).
+
+## Open the pull request
+
+Push your branch and open a pull request against `master`. Complete the template with scope, verification evidence, security and provider-cost impact, and documentation changes.
+
+Disclose AI-assisted work by naming the tool, describing its contribution, and stating how you reviewed the result. You remain responsible for every submitted line.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ProofOfTechOrg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.