feat: deep-think toggle, i18n, followup removal, storage hardening

[Rookiecoder-jsjs]

Chat UX:

• Deep Think toggle (Qwen hybrid-thinking): reasoning_content streamed as event: thinking SSE frames before the answer body; 400-fallback retries without enable_thinking for model tiers that reject the param; frontend toggle persists in localStorage, collapsible reasoning block with timing.
• Follow-up question chips removed end-to-end (model field, API path, SSE done-frame, frontend chips/handler/css, tests, eval gold case).
• ChatPage UI translated to Chinese (timing chip, sources, feedback, errors).

Storage / ops:

• docker-compose: bypass chromadb 0.4.18 entrypoint's pip install --force-reinstall chroma-hnswlib (pulls numpy 2.x → np.float_ removed → crash loop); run uvicorn directly. Real bind-mount persistence to ./data/chromadb; ./data/neo4j bind-mounts for graph data.
• scripts/rebuild_chroma.py: zero-API-cost vector rebuild from SQLite chunks + embedding_cache (md5-keyed). Reuses get_chroma_client so collection name/cosine/upsert match ingestion; metadata fields mirror documents.py:287-296 verbatim. Recovery path for future vector loss.

Infra (earlier batch):

• SSE client util + doc_status service + rate_limit middleware.
• Embedding cache self-heal (corrupt JSON/pickle blobs pruned).
• Neo4j batch chunk/link writes (UNWIND) replacing per-chunk round-trips.
• entity_extractor refactor; progress_tracker; reranker.
• tests: +conftest, +test_doc_status, +test_sse; -test_followups, -eval/06.

Verified: 54 chunks repopulated into Chroma (0 cache misses, 0 API calls); collection count=54; metadata user_id/document_id/prev_next intact.

[ecc-tools]

Analyzing 200 commits...

[ecc-tools]

Analysis Complete

Generated ECC bundle from 1 commits | Confidence: 55%

View Pull Request #2

Repository Profile

Attribute	Value
Language	Python
Framework	Not detected
Commit Convention	conventional
Test Directory	mixed

Changed Files (35)

Metric	Value
Files changed	35
Additions	2430
Deletions	1073

Top hotspots

Path	Status	+/-
frontend/src/views/ChatPage.vue	modified	+384 / -162
backend/app/services/llm.py	modified	+283 / -117
backend/tests/test_followups.py	removed	+0 / -358
backend/app/services/entity_extractor.py	modified	+84 / -196
backend/tests/test_doc_status.py	added	+219 / -0

Top directories

Directory	Files	Total changes
backend/app/services	8	1158
backend/tests	5	595
frontend/src/views	2	548
backend/app/api	4	452
.	4	183

Analysis Depth Readiness (evidence-backed, 36%)

ECC Tools uses this to decide whether recommendations should stay at commit-history/setup guidance or expand into CI, security, harness, reference-set, AI-routing, and team backlog work.

Area	Status	Evidence / Next Step
Commit history	Partial	1 commits sampled
CI/CD signals	Missing	Add workflow files or CI troubleshooting evidence so ECC Tools can reason about pipeline setup.
Security evidence	Missing	Add AgentShield, audit, SARIF, SBOM, or security review evidence so recommendations can cover security posture.
Harness configuration	Missing	Add Claude, Codex, OpenCode, Zed, dmux, MCP, plugin, or cross-harness config evidence for harness-agnostic recommendations.
Reference/eval evidence	Ready	backend/eval/gold/06_followup.json
AI routing and cost controls	Ready	CLAUDE.md, backend/app/services/llm.py
Team handoff and project tracking	Missing	Add roadmap, runbook, project, Linear, or follow-up tracking docs so generated work can land in a team queue.

Reference Set Readiness (0/7, 0%)

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Likely Future Issues (10)

Severity	Signal	Why it may show up
HIGH	Regression coverage may lag behind the diff	17 generic code paths changed; 0 test files changed
HIGH	API contract changes may ship without integration coverage	5 API surface paths changed; 0 integration or e2e tests changed
MEDIUM	API implementation changes may ship without contract artifact updates	5 API implementation paths changed; 0 API contract/spec files changed
HIGH	Schema or model changes may ship without migration follow-up	3 schema/model paths changed; 0 migration files changed
MEDIUM	Runtime config changes may ship without example or template updates	1 runtime config paths changed; 0 example or template config files changed
HIGH	Auth or permission changes may ship without security regression coverage	2 auth/permission paths changed; 0 auth-focused integration or e2e tests changed
MEDIUM	User-facing UI changes may ship without browser coverage	5 user-facing UI paths changed; 0 browser or e2e coverage files changed
HIGH	Security-sensitive changes may ship without scanner evidence	2 security-sensitive paths changed; 0 security scanner or security-focused validation artifacts changed
MEDIUM	Cost or token-risk changes may ship without budget evidence	2 cost/token-risk paths changed; 0 budget, usage, or cost validation artifacts changed
MEDIUM	RAG or evaluator changes may ship without comparison evidence	2 RAG/evaluator path(s) changed; 0 RAG/evaluator comparison evidence artifacts changed

• Regression coverage may lag behind the diff: The PR changes multiple code paths but does not touch any obvious test files.
• API contract changes may ship without integration coverage: The PR changes API or route-facing files but does not touch any obvious integration or end-to-end tests.
• API implementation changes may ship without contract artifact updates: The PR changes API implementation files but does not touch any obvious OpenAPI, GraphQL, or contract/spec artifact.
• Schema or model changes may ship without migration follow-up: The PR changes schema or model-facing files but does not include any obvious migration artifact.
• Runtime config changes may ship without example or template updates: The PR changes runtime config or deployment settings but does not update any obvious example env file or config template.
• Auth or permission changes may ship without security regression coverage: The PR changes auth, session, middleware, or permission-sensitive files without touching any obvious auth-focused integration or end-to-end tests.
• User-facing UI changes may ship without browser coverage: The PR changes components, pages, or other user-facing UI files without touching any obvious browser or end-to-end coverage.
• Security-sensitive changes may ship without scanner evidence: The PR touches billing, secrets, auth, webhooks, agent, or CI-sensitive surfaces without adding obvious security scanner, code scanning, or security-focused validation evidence.
• Cost or token-risk changes may ship without budget evidence: The PR changes AI routing, usage, token budget, or model-call surfaces without touching obvious budget, usage-limit, or cost regression evidence.
• RAG or evaluator changes may ship without comparison evidence: The PR changes RAG, retrieval, embedding, ranking, or evaluator surfaces without touching reference-set, eval, golden trace, or benchmark evidence.

Suggested Follow-up Work (10)

Type	Suggested title	Targets
PR	test: add regression coverage for backend/app/api/auth.py + backend/app/api/chat.py	backend/app/api/auth.py, backend/app/api/chat.py
PR	test: add integration coverage for backend/app/api/auth.py + backend/app/api/chat.py	backend/app/api/auth.py, backend/app/api/chat.py
PR	docs: sync API contract for backend/app/api/auth.py + backend/app/api/chat.py	backend/app/api/auth.py, backend/app/api/chat.py
PR	db: add migration follow-up for backend/app/models/chat.py + backend/app/models/document.py	backend/app/models/chat.py, backend/app/models/document.py
PR	chore: sync config templates for docker-compose.yml	docker-compose.yml
PR	test: add auth coverage for backend/app/api/auth.py + backend/app/auth/rate_limit.py	backend/app/api/auth.py, backend/app/auth/rate_limit.py
PR	test: add browser coverage for frontend/src/api/chat.js + frontend/src/utils/sse.js	frontend/src/api/chat.js, frontend/src/utils/sse.js
PR	security: add scanner evidence for backend/app/api/auth.py + backend/app/auth/rate_limit.py	backend/app/api/auth.py, backend/app/auth/rate_limit.py
PR	test: add budget evidence for CLAUDE.md + backend/app/services/llm.py	CLAUDE.md, backend/app/services/llm.py
PR	analysis: add RAG/evaluator evidence for backend/app/services/embedding.py + backend/app/services/reranker.py	backend/app/services/embedding.py, backend/app/services/reranker.py

• test: add regression coverage for backend/app/api/auth.py + backend/app/api/chat.py: Backfill regression coverage before another change set lands on the touched code paths.
• test: add integration coverage for backend/app/api/auth.py + backend/app/api/chat.py: Backfill integration or end-to-end coverage for the changed API surface before more contract changes land.
• docs: sync API contract for backend/app/api/auth.py + backend/app/api/chat.py: Backfill the missing API contract or spec update before another implementation change lands on top of the same surface.
• db: add migration follow-up for backend/app/models/chat.py + backend/app/models/document.py: Backfill the missing migration artifact before another schema or model change lands on top.
• chore: sync config templates for docker-compose.yml: Backfill example env files or config templates before a fresh setup drifts from the shipped runtime surface.
• test: add auth coverage for backend/app/api/auth.py + backend/app/auth/rate_limit.py: Backfill auth or permission regression coverage before another access-control change lands on the touched surface.
• test: add browser coverage for frontend/src/api/chat.js + frontend/src/utils/sse.js: Backfill browser coverage before another user-facing UI change lands on the touched surface.
• security: add scanner evidence for backend/app/api/auth.py + backend/app/auth/rate_limit.py: Backfill explicit scanner or code-scanning evidence before another security-sensitive change lands on the touched surface.
• test: add budget evidence for CLAUDE.md + backend/app/services/llm.py: Backfill cost, token, or usage-limit validation before another model-routing change lands on the touched surface.
• analysis: add RAG/evaluator evidence for backend/app/services/embedding.py + backend/app/services/reranker.py: Backfill reference-set comparison, golden trace, benchmark, or eval-run evidence before another RAG or evaluator change lands on the touched surface.

Copy-ready bodies

test: add regression coverage for backend/app/api/auth.py + backend/app/api/chat.py

## Summary
- Add regression coverage for the recently touched code paths before more changes stack on top.

## Why
- Backfill regression coverage before another change set lands on the touched code paths.

## Touched paths
- `backend/app/api/auth.py`
- `backend/app/api/chat.py`

## Validation
- Add or extend focused tests that exercise the touched paths.
- Run the affected test suite and verify the new coverage closes the gap.

test: add integration coverage for backend/app/api/auth.py + backend/app/api/chat.py

## Summary
- Add integration or end-to-end coverage for the recently changed API surface.

## Why
- Backfill integration or end-to-end coverage for the changed API surface before more contract changes land.

## Touched paths
- `backend/app/api/auth.py`
- `backend/app/api/chat.py`

## Validation
- Add or extend integration / e2e coverage for the changed API, route, or contract surface.
- Exercise the touched endpoints or route handlers against realistic request / response flows.

docs: sync API contract for backend/app/api/auth.py + backend/app/api/chat.py

## Summary
- Update the API contract artifact that should reflect the recently changed implementation surface.

## Why
- Backfill the missing API contract or spec update before another implementation change lands on top of the same surface.

## Touched paths
- `backend/app/api/auth.py`
- `backend/app/api/chat.py`

## Validation
- Update the relevant OpenAPI, GraphQL, or contract/spec artifact used by this repo.
- Run the contract validation, docs generation, or API verification flow that depends on that artifact.

db: add migration follow-up for backend/app/models/chat.py + backend/app/models/document.py

## Summary
- Add the missing migration or schema rollout step for the recently changed schema surface.

## Why
- Backfill the missing migration artifact before another schema or model change lands on top.

## Touched paths
- `backend/app/models/chat.py`
- `backend/app/models/document.py`

## Validation
- Create the migration or schema rollout artifact used by this repo.
- Run the repo migration / schema validation flow and verify the changed models still match production expectations.

chore: sync config templates for docker-compose.yml

## Summary
- Update the example env files, sample configs, or deployment templates that should mirror the changed runtime configuration surface.

## Why
- Backfill example env files or config templates before a fresh setup drifts from the shipped runtime surface.

## Touched paths
- `docker-compose.yml`

## Validation
- Update the repo example env file or config template that should reflect the new runtime settings.
- Run the setup, boot, or deployment validation flow that depends on the changed config surface.

test: add auth coverage for backend/app/api/auth.py + backend/app/auth/rate_limit.py

## Summary
- Add auth, session, or permission regression coverage for the recently changed security-sensitive surface.

## Why
- Backfill auth or permission regression coverage before another access-control change lands on the touched surface.

## Touched paths
- `backend/app/api/auth.py`
- `backend/app/auth/rate_limit.py`

## Validation
- Add or extend integration / e2e coverage for the changed auth, session, middleware, or permission surface.
- Exercise allowed and denied flows, invalid or expired credentials, or equivalent access-control boundary cases.

test: add browser coverage for frontend/src/api/chat.js + frontend/src/utils/sse.js

## Summary
- Add browser or end-to-end coverage for the recently changed user-facing surface.

## Why
- Backfill browser coverage before another user-facing UI change lands on the touched surface.

## Touched paths
- `frontend/src/api/chat.js`
- `frontend/src/utils/sse.js`

## Validation
- Add or extend browser / e2e coverage for the changed component, page, or flow.
- Exercise the visible user journey that depends on the touched UI surface.

security: add scanner evidence for backend/app/api/auth.py + backend/app/auth/rate_limit.py

## Summary
- Add security scanner or code-scanning evidence for the recently changed security-sensitive surface.

## Why
- Backfill explicit scanner or code-scanning evidence before another security-sensitive change lands on the touched surface.

## Touched paths
- `backend/app/api/auth.py`
- `backend/app/auth/rate_limit.py`

## Validation
- Run or add the relevant security scanner, code scanning, secret scanning, or dependency/security review check for the touched surface.
- Attach the scanner output, SARIF/code-scanning result, or focused security regression test to the follow-up PR.
- Confirm the changed auth, billing, webhook, secret-handling, agent, or CI surface has an explicit pass/fail gate.

test: add budget evidence for CLAUDE.md + backend/app/services/llm.py

## Summary
- Add budget or usage-limit validation for the recently changed AI routing or model-call surface.

## Why
- Backfill cost, token, or usage-limit validation before another model-routing change lands on the touched surface.

## Touched paths
- `CLAUDE.md`
- `backend/app/services/llm.py`

## Validation
- Add or extend budget, token, usage-limit, or model-routing regression coverage for the changed path.
- Verify the route still enforces plan limits, retry caps, fallback behavior, or explicit cost controls.

analysis: add RAG/evaluator evidence for backend/app/services/embedding.py + backend/app/services/reranker.py

## Summary
- Add RAG/evaluator comparison evidence for the recently changed retrieval, ranking, embedding, or evaluator surface.

## Why
- Backfill reference-set comparison, golden trace, benchmark, or eval-run evidence before another RAG or evaluator change lands on the touched surface.

## Touched paths
- `backend/app/services/embedding.py`
- `backend/app/services/reranker.py`

## Validation
- Add or update an eval, reference set, golden trace, benchmark, fixture, or judge/scoring regression for the changed RAG/evaluator behavior.
- Compare the changed behavior against representative retrieval or evaluator cases and record pass/fail evidence.
- Confirm the follow-up evidence covers the same retrieval, embedding, ranking, or evaluator path touched by this PR.

Generated Instincts (18)

Domain	Count
git	4
code-style	10
architecture	1
testing	3

After merging, import with:

/instinct-import .claude/homunculus/instincts/inherited/GraphRAG-instincts.yaml

Files

• .claude/ecc-tools.json
• .claude/skills/GraphRAG/SKILL.md
• .agents/skills/GraphRAG/SKILL.md
• .agents/skills/GraphRAG/agents/openai.yaml
• .claude/identity.json
• .codex/config.toml
• .codex/AGENTS.md
• .codex/agents/explorer.toml
• .codex/agents/reviewer.toml
• .codex/agents/docs-researcher.toml
• .claude/homunculus/instincts/inherited/GraphRAG-instincts.yaml

---

_{ECC Tools | Everything Claude Code}