Repository navigation
fix(SEC-P2-20261025): 修補前端工具鏈並移除 Chroma 受影響相依 - #13
Merged
Merged
Conversation
- 完成隔離分支的適用安全修補及回歸證據。 - 保留原始工作目錄、未提交修改與長期分支。 驗證與限制：見 security/reports/2026-10-25-p2-remediation.md；未驗項目不標通過，尚未推送、合併或部署。
以LangChain Core處理本機RAG，每次問答從SQLite重建，保留舊索引目錄；固定mock向量，來源與答案上下文一致。 驗證：乾淨70依賴無Chroma且公告0、9個Python行為測試與5個前端煙霧通過；100／1000合成筆記暖p95 6.53／61.28ms符合ADR門檻，未評真實模型品質。
frobel0520
changed the title
frobel0520
marked this pull request as ready for review
October 25, 2026 03:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Task: SEC-P2-20261025；ADR-006。
修補前端Vite／Supabase／Playwright與Actions SHA，並依使用者核准移除無修補版的Chroma相依。改用既有LangChain Core的記憶體向量索引，每次問答由SQLite筆記重建；CRUD只寫SQLite。既有筆記與舊Chroma目錄保留、不讀寫，不重啟已停用的雲端API。
驗證：乾淨Python3.12環境70個解析版本公告0、無chromadb／langchain_chroma且pip check成功；9個真實SQLite/API/檢索/舊目錄保留測試通過，新增兩測試在替換前失敗。前端原5個煙霧測試通過（本機既有Chromium1234啟動覆寫；CI用鎖定Playwright的瀏覽器）。
效能：同硬體384維mock，100／1000合成筆記各2暖身+20問答，新暖p95 6.53／61.28ms，低於量測前500／2000ms門檻；1000筆冷重建28.56ms<5000ms。每次重建比舊持久索引查詢慢（1000筆舊p95 4.71ms），此取捨已記ADR；不冒稱正式延遲或真實模型品質。
4個Chroma公告以移除套件處置，非宣稱上游已修補。去敏證據見security/reports/2026-10-25-p2-remediation.md/.json。等待本次提交的新CI後合併至dev；原始工作樹保留，不操作私人筆記、不啟用付費服務。