Skip to content

Traceable RAG v0.5.0 - First Public Release

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Aug 06:46
v0.5.0
41dc92e

Traceable RAG v0.5.0

Traceable RAG is now available as a public, auditable document-retrieval service for AI agents. It returns knowledge-base-scoped evidence, bounded adjacent context, and stable Source links that open the original PDF page with the relevant region highlighted.

The server handles document processing, retrieval, and source verification. The calling agent keeps control of question decomposition and final answer writing.

Install on Linux

Docker Engine and Docker Compose v2 are required. The published image supports linux/amd64 and linux/arm64.

curl -fsSL https://github.com/yo-solo/traceable-rag/releases/download/v0.5.0/install.sh | sh

The installer verifies SHA256SUMS and release-manifest.json, pins the accepted image digest, runs as the installing user's UID and GID, and binds to 127.0.0.1:8000 by default. See the getting-started guide for checksum-first installation, Windows PowerShell, custom ports, Provider setup, the Codex Skill, backup, upgrade, rollback, and recovery.

What is included

  • Retrieval, optional bounded Source Context, and page-level PDF verification for external AI agents
  • Layout-aware PDF, DOCX, and image processing with asynchronous jobs and visible failure states
  • Independent MinerU, Embedding, Reranker, and optional LLM profiles with AES-256-GCM encrypted secrets
  • Fixed-digest deployment bundles, non-root containers, loopback binding, health checks, backup, rollback, and recovery
  • A bilingual README, generated architecture overview, public contribution and security policies, and four licensed ViDoRe sample PDFs

Verified release identity

Item Accepted value
Git tag v0.5.0
Source commit 41dc92e59a5720f2507a7d1b4e1be5f3863c7b4f
Image ghcr.io/yo-solo/traceable-rag-public
Multi-architecture digest sha256:f07c31859df088765cc3c0cece3d128be0dbae81f498cbf8148b62968fe131c5
linux/amd64 sha256:7105d9d92a1703ad797f73b80c7f62185123561ec76fd55330c60b05c35ee6df
linux/arm64 sha256:bac9712180ebb574bb5ac3792643b852d0a94bed3f426f8a3a2f2e5037f2a80d

The Git tag and release-manifest.json bind the release to the source commit. Both platform images carry org.opencontainers.image.source=https://github.com/yo-solo/traceable-rag and org.opencontainers.image.licenses=MIT labels. GHCR stores the combined image as a Docker manifest list, so this release does not claim an OCI revision annotation on the index itself.

The release workflow accepted four fixed-hash ViDoRe excerpts, five Retrieval and Source probes, browser screenshots, two SPDX SBOMs, critical-vulnerability scans, and linux/arm64 startup under QEMU. The recovery run rechecked the original acceptance artifact and the raw GHCR manifest bytes before publishing the immutable version image and aliases.

Post-publication Linux canary

The public URLs were tested after publication on a Debian 12 linux/amd64 host under a normal non-root user. The canary downloaded all eight Release assets anonymously, verified all seven checksum entries, and pulled the exact index digest through a fresh Docker configuration with no registry login.

The fixed-digest bundle installed with automatic startup disabled, then started separately on 127.0.0.1:18080. The checks covered the runtime UID and GID, no-new-privileges, live and ready health, a Provider-free doctor run, an isolated Codex Skill install and contract check, backup integrity, and ordinary uninstall. The canary container and network were removed afterward. Its data, configuration, backup, evidence, Skill, and image were retained, while the pre-existing Traceable RAG service kept the same container identity and remained healthy.

Real MinerU, Embedding, Reranker, and LLM Provider E2E were not run during release automation. Native macOS, Windows, and Linux arm64 full user journeys also remain untested. The published evidence does not imply those results.

License and samples

Source code and original documentation use the MIT License. The Traceable RAG name, logos, and brand assets remain subject to the separate trademark policy. The included ViDoRe excerpts remain CC BY 4.0 with source, page, revision, attribution, and SHA-256 records in the sample manifest.

Traceable RAG 现已作为公开项目发布。它面向外部 AI 智能体提供有明确知识库范围的证据检索、有限相邻上下文和稳定 Source 链接。读者可以打开链接，回到 PDF 原页并直接核对高亮区域。

服务负责文档处理、检索和来源定位。问题拆解与最终回答仍由调用它的智能体完成。

Linux 安装

需要 Docker Engine 和 Docker Compose v2。发布镜像支持 linux/amd64 与 linux/arm64。

curl -fsSL https://github.com/yo-solo/traceable-rag/releases/download/v0.5.0/install.sh | sh

安装器会核验 SHA256SUMS 和 release-manifest.json，固定已验收的镜像 digest，按安装者的 UID 和 GID 运行容器，并默认只监听 127.0.0.1:8000。校验和优先安装、Windows PowerShell、自定义端口、Provider 配置、Codex Skill、备份、升级、回滚和恢复见快速上手。

本次公开内容

  • 面向外部智能体的 Retrieval、可选 Source Context 与 PDF 原页核验
  • 支持 PDF、DOCX 和图片的版式感知处理、异步任务与可见失败状态
  • MinerU、Embedding、Reranker 和可选 LLM 独立配置，密钥使用 AES-256-GCM 加密持久化
  • 固定 digest 的部署包、非 root 容器、回环监听、健康检查、备份、回滚与恢复
  • 双语 README、生成式架构图、公开协作与安全规范，以及四份有明确许可的 ViDoRe PDF 节选

发布身份

项目 验收值
Git tag v0.5.0
源提交 41dc92e59a5720f2507a7d1b4e1be5f3863c7b4f
镜像 ghcr.io/yo-solo/traceable-rag-public
多架构 digest sha256:f07c31859df088765cc3c0cece3d128be0dbae81f498cbf8148b62968fe131c5
linux/amd64 sha256:7105d9d92a1703ad797f73b80c7f62185123561ec76fd55330c60b05c35ee6df
linux/arm64 sha256:bac9712180ebb574bb5ac3792643b852d0a94bed3f426f8a3a2f2e5037f2a80d

Git tag 与 release-manifest.json 共同绑定源提交。两个平台镜像均带有 org.opencontainers.image.source=https://github.com/yo-solo/traceable-rag 和 org.opencontainers.image.licenses=MIT 标签。GHCR 将组合镜像保存为 Docker manifest list，因此本版本不声明 index 自身带有 OCI revision annotation。

发布门禁核验了四份固定哈希的 ViDoRe 节选、五组 Retrieval 与 Source 探针、浏览器截图、两份 SPDX SBOM、关键漏洞扫描，以及 QEMU 下的 linux/arm64 启动。恢复 run 在发布 immutable 版本镜像和别名前，再次核对了原始验收 artifact 与 GHCR manifest 原始字节。

发布后 Linux canary

Release 发布后，一台 Debian 12 linux/amd64 主机以普通非 root 用户完成了公开 URL canary。测试从匿名地址下载全部八个 Release 资产，核验七项 checksum，并在没有 registry login 的全新 Docker 配置下拉取精确 index digest。

固定 digest 部署包先关闭自动启动完成安装，随后单独在 127.0.0.1:18080 启动。验收覆盖运行时 UID 与 GID、no-new-privileges、live 与 ready、没有请求 Provider 测试的 doctor、隔离 Codex Skill 安装与契约检查、备份完整性和普通卸载。结束后，canary 容器与网络已移除，数据、配置、备份、证据、Skill 和镜像继续保留。原有 Traceable RAG 服务的容器身份没有变化，健康检查保持正常。

发布自动化没有运行真实 MinerU、Embedding、Reranker 和 LLM Provider E2E。macOS、Windows 与 Linux arm64 的原生完整用户流程也尚未执行。本次发布证据不包含这些结论。

许可与样例

源码与原创文档采用 MIT License。Traceable RAG 名称、Logo 与品牌资产另行受商标政策约束。仓库中的 ViDoRe 节选继续使用 CC BY 4.0，来源、页码、revision、署名和 SHA-256 记录见样例清单。

Assets 10
Loading