Merge main and bundle Sentry configuration

Author: KostasCherv

.env.example

@@ -14,6 +14,7 @@ OPENAI_MODEL=gpt-4o-mini
 # ROUTER_OLLAMA_BASE_URL=
 # ROUTER_LMSTUDIO_MODEL=
 # ROUTER_TEMPERATURE=0.0
+# ROUTER_TIMEOUT_SECONDS=10.0
 
 # Ollama settings (required if LLM_PROVIDER=ollama)
 OLLAMA_BASE_URL=http://localhost:11434

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
           --cov-report=xml:coverage.xml
       - name: Upload backend coverage
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: backend-coverage
           path: coverage.xml
@@ -50,7 +50,7 @@ jobs:
         run: uv run python -m src.evals.regression_gate --output reports/ai-regression-${{ github.sha }}.json
       - name: Upload AI regression score
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ai-regression-${{ github.sha }}
           path: reports/ai-regression-${{ github.sha }}.json
@@ -64,7 +64,7 @@ jobs:
         working-directory: ui
     steps:
       - uses: actions/checkout@v5
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm
@@ -79,7 +79,7 @@ jobs:
         run: npm run test:coverage
       - name: Upload UI coverage
         if: always()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: ui-coverage
           path: ui/coverage/
@@ -90,7 +90,7 @@ jobs:
         run: npx playwright test
       - name: Upload Playwright failure artifacts
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: playwright-failure-artifacts
           path: |
@@ -115,7 +115,7 @@ jobs:
           output: cortex-sbom.cdx.json
           scanners: vuln
       - name: Upload container SBOM
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cortex-sbom-${{ github.sha }}
           path: cortex-sbom.cdx.json

README.md

@@ -8,12 +8,10 @@
 
 Cortex combines LangGraph orchestration, GraphRAG retrieval, durable background jobs, and end-to-end observability in a FastAPI and React application.
 
-<img width="1722" height="898" alt="Cortex research workspace showing a generated report and source-grounded chat" src="https://github.com/user-attachments/assets/1f01409f-bc58-43ef-bc09-5ec2649acf00" />
+<video src="https://github.com/user-attachments/assets/fe5c280c-bbdc-4d49-8e9c-655a256b6b6f" controls></video>
+
 
-## Promo video
 
-Watch Cortex move from workspace chat to a live research run and grounded follow-up questions:
-[MP4](assets/promo/cortex-research-promo.mp4) · [WebM](assets/promo/cortex-research-promo.webm)
 
 ## Why Cortex
 

cloudrun/service.yaml

@@ -46,23 +46,20 @@ spec:
               value: "openai"
             - name: OPENAI_MODEL
               value: "gpt-4o-mini"
+            - name: ROUTER_TIMEOUT_SECONDS
+              value: "10.0"
             - name: EMBEDDING_PROVIDER
               value: "openai"
             - name: EMBEDDING_MODEL
               value: "text-embedding-3-small"
             - name: EMBEDDING_DIMENSIONS
               value: "1536"
-            - name: OPENAI_API_KEY
+            - name: PROVIDER_CONFIG_JSON
               valueFrom:
                 secretKeyRef:
-                  name: openai-api-key
+                  name: provider-config
                   key: latest
             # --- Search ---
-            - name: TAVILY_API_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: tavily-api-key
-                  key: latest
             # --- Graph store (Neo4j Aura) ---
             # URI and username are not sensitive; only the password lives in Secret Manager.
             - name: NEO4J_URI
@@ -91,16 +88,28 @@ spec:
             - name: READINESS_REQUIRE_NEO4J
               value: "true"
             # --- Inngest ---
-            - name: INNGEST_EVENT_KEY
+            - name: INNGEST_CONFIG_JSON
               valueFrom:
                 secretKeyRef:
-                  name: inngest-event-key
+                  name: inngest-config
                   key: latest
-            - name: INNGEST_SIGNING_KEY
+            # --- Billing (Stripe) ---
+            - name: BILLING_CONFIG_JSON
               valueFrom:
                 secretKeyRef:
-                  name: inngest-signing-key
+                  name: billing-config
                   key: latest
+            # --- Redis cache ---
+            # REDIS_URL is bundled into PROVIDER_CONFIG_JSON to stay within the
+            # Secret Manager free active-version allowance.
+            - name: REDIS_CACHE_TTL_DB_LIST_SECONDS
+              value: "30"
+            - name: STRIPE_SUCCESS_URL
+              value: "https://cortex-ai-prod.vercel.app/billing/success"
+            - name: STRIPE_CANCEL_URL
+              value: "https://cortex-ai-prod.vercel.app/billing/cancel"
+            - name: STRIPE_PORTAL_RETURN_URL
+              value: "https://cortex-ai-prod.vercel.app"
             # --- CORS ---
             - name: CORS_ORIGINS
               value: '["https://cortex-ai-prod.vercel.app"]'
@@ -111,14 +120,9 @@ spec:
                   name: internal-dispatch-secret
                   key: latest
             # --- Observability ---
-            # ponytail: observability off for the free-tier deploy; re-add
-            # langsmith-api-key / langfuse-* secrets when tracing matters.
-            - name: SENTRY_DSN
-              valueFrom:
-                secretKeyRef:
-                  name: sentry-dsn
-                  key: latest
             - name: SENTRY_ENVIRONMENT
               value: "production"
             - name: LANGSMITH_TRACING
               value: "false"
+            - name: LANGFUSE_ENABLED
+              value: "true"

docs/architecture.md

@@ -66,12 +66,14 @@ Routing policy:
 
 - Greetings and other social turns normally resolve directly.
 - Weak or empty RAG context does not automatically trigger web search.
+- Missing pre-retrieved RAG context does not mean resources are absent; explicit requests about uploaded documents route to `answer_from_rag`, then retrieval runs.
+- Custom-agent routing receives the agent name, description, and linked/attached resource counts so short domain questions can still select `answer_from_rag` and retain citations.
 - Web search is selected for external, fresh, or otherwise web-dependent information.
 - A URL in the message or history is available context, not an automatic fetch instruction.
 - Direct URL fetching happens only when inspecting the resource is necessary.
 - Agent chat, workspace chat, and streaming/non-streaming endpoints use the same policy.
 
-Workspace and agent document collections are deny-by-default: Cortex retrieves them only when the router explicitly selects `answer_from_rag`. Session attachments remain available as explicitly scoped resources. A routing failure after one structured-output repair returns `router_error` and does not retrieve documents.
+The workspace-wide document collection is deny-by-default: Cortex retrieves it only when the router explicitly selects `answer_from_rag`. A custom agent's linked resources and session attachments are explicitly scoped resources, so they remain available on every turn. A routing failure after one structured-output repair returns `router_error` and does not retrieve documents.
 
 ## Reliable ingestion
 

docs/billing.md

@@ -4,7 +4,7 @@ Cortex uses Stripe Hosted Checkout, signed webhooks, and the customer portal for
 
 ## Configuration
 
-Required variables:
+Required local-development variables:
 
 - `STRIPE_SECRET_KEY`
 - `STRIPE_WEBHOOK_SECRET`
@@ -13,6 +13,11 @@ Required variables:
 - `STRIPE_CANCEL_URL`
 - `STRIPE_PORTAL_RETURN_URL`
 
+In production, Cloud Run uses one `BILLING_CONFIG_JSON` Secret Manager value containing
+`stripe_secret_key`, `stripe_webhook_secret`, and `stripe_pro_price_id`; the three redirect
+URLs remain ordinary environment variables. This keeps the Stripe credentials within one
+active secret version.
+
 Store production secret values in Google Secret Manager. See [Production configuration](env-vars-production.md).
 
 ## Webhook setup
@@ -46,4 +51,3 @@ flowchart LR
 ```
 
 Webhook events are the authoritative source for subscription state. The backend verifies the Stripe signature before updating `user_subscriptions`; research and chat quota guards then read the synchronized subscription and usage state.
-

docs/env-vars-production.md

@@ -8,14 +8,14 @@ All secrets should be stored in **Google Secret Manager** and referenced via `va
 
 | Env Var | Secret Manager | Notes |
 |---|---|---|
-| `OPENAI_API_KEY` | yes | Required when `LLM_PROVIDER=openai` |
+| `PROVIDER_CONFIG_JSON` | yes | Secret JSON with provider, Redis, Langfuse, LangSmith, and Sentry settings: `openai_api_key`, `tavily_api_key`, `redis_url`, `langfuse_public_key`, `langfuse_secret_key`, `langfuse_base_url`, `langsmith_api_key`, `langsmith_project`, `langsmith_endpoint`, `langsmith_redaction_mode`, `langsmith_sampling_rate`, `langsmith_tracing`, and `sentry_dsn`. Required when `LLM_PROVIDER=openai`. |
 | `OPENROUTER_API_KEY` | yes | Required when `LLM_PROVIDER=openrouter` |
 | `LLM_PROVIDER` | no | `openai` or `openrouter` |
 | `OPENAI_MODEL` | no | e.g. `gpt-4o-mini` |
+| `ROUTER_TIMEOUT_SECONDS` | no | Maximum duration of each router LLM request; production uses `10.0` |
 | `EMBEDDING_PROVIDER` | no | `openai` |
 | `EMBEDDING_MODEL` | no | `text-embedding-3-small` |
 | `EMBEDDING_DIMENSIONS` | no | `1536` |
-| `TAVILY_API_KEY` | yes | |
 | `ALPHA_VANTAGE_API_KEY` | yes | Required when `ASSET_PRICE_PROVIDER=alphavantage_mcp` |
 | `ASSET_PRICE_PROVIDER` | no | `alphavantage_mcp` |
 | `ALPHA_VANTAGE_MCP_URL` | no | Optional full remote MCP URL override |
@@ -31,12 +31,9 @@ All secrets should be stored in **Google Secret Manager** and referenced via `va
 | `READINESS_REQUIRE_SUPABASE` | no | Set to `true` in production; `/ready` returns `503` if Supabase is missing or unavailable |
 | `READINESS_REQUIRE_NEO4J` | no | Set to `true` in production; `/ready` returns `503` if Neo4j is missing or unavailable |
 | `READINESS_TIMEOUT_SECONDS` | no | Per-dependency probe timeout; defaults to `2.0` seconds |
-| `INNGEST_EVENT_KEY` | yes | From Inngest dashboard → Keys |
-| `INNGEST_SIGNING_KEY` | yes | From Inngest dashboard → Keys. **Must not be empty in prod.** |
-| `REDIS_URL` | yes | Upstash `rediss://` URL |
-| `STRIPE_SECRET_KEY` | yes | |
-| `STRIPE_WEBHOOK_SECRET` | yes | Update Stripe webhook URL to `https://<cloud-run-url>/api/billing/webhook` after first deploy |
-| `STRIPE_PRO_PRICE_ID` | no | |
+| `INNGEST_CONFIG_JSON` | yes | Secret JSON with `inngest_event_key` and `inngest_signing_key` from the Inngest dashboard. |
+| `REDIS_CACHE_TTL_DB_LIST_SECONDS` | no | Cache TTL for DB-heavy list/read-all responses; production uses `30`. `REDIS_URL` is supplied through `PROVIDER_CONFIG_JSON`. |
+| `BILLING_CONFIG_JSON` | yes | Secret JSON with `stripe_secret_key`, `stripe_webhook_secret`, and `stripe_pro_price_id`. This bundles Stripe credentials into one Secret Manager version. |
 | `STRIPE_SUCCESS_URL` | no | `https://<frontend>/billing/success` |
 | `STRIPE_CANCEL_URL` | no | `https://<frontend>/billing/cancel` |
 | `STRIPE_PORTAL_RETURN_URL` | no | `https://<frontend>` |
@@ -48,11 +45,11 @@ All secrets should be stored in **Google Secret Manager** and referenced via `va
 | Env Var | Secret Manager | Notes |
 |---|---|---|
 | `COHERE_API_KEY` | yes | Enables cross-encoder reranking |
-| `LANGFUSE_PUBLIC_KEY` | yes | |
-| `LANGFUSE_SECRET_KEY` | yes | |
+| `LANGFUSE_ENABLED` | no | Production sets this to `true`; Langfuse credentials and base URL are supplied through `PROVIDER_CONFIG_JSON`. |
+| `LANGSMITH_*` | no | LangSmith tracing, API key, project, endpoint, redaction mode, and sampling rate are supplied through `PROVIDER_CONFIG_JSON`. |
 | `LANGFUSE_ENV` | no | `prod` |
 | `LANGFUSE_RELEASE` | no | Git SHA or semver, e.g. `v1.2.3` |
-| `SENTRY_DSN` | yes | Error tracking; unset disables it entirely |
+| `SENTRY_DSN` | no | Local/split-variable fallback. Production stores `sentry_dsn` inside `PROVIDER_CONFIG_JSON`; unset disables Sentry entirely. |
 | `SENTRY_ENVIRONMENT` | no | Sentry issue environment; production deploys set this to `production` |
 | `RATE_LIMIT_DEFAULT` | no | Per-IP request limit, e.g. `60/minute` (default) |
 
@@ -90,19 +87,16 @@ PROJECT=cortex-496709
 REGION=your-region
 
 secrets=(
-  openai-api-key
-  tavily-api-key
+  provider-config
   cohere-api-key
   neo4j-uri
   neo4j-username
   neo4j-password
   supabase-secret-key
   supabase-jwt-secret
-  inngest-event-key
-  inngest-signing-key
+  inngest-config
   redis-url
-  stripe-secret-key
-  stripe-webhook-secret
+  billing-config
   internal-dispatch-secret
   langfuse-public-key
   langfuse-secret-key
@@ -137,7 +131,7 @@ Configure email alerts for terminal failures in every registered function and fo
 
 ## Alerting post-deploy wiring
 
-After creating a Sentry Python/FastAPI project, add its DSN to `.env.prod` as `SENTRY_DSN` or populate the `sentry-dsn` Secret Manager secret manually. Then deploy and configure a Sentry email issue alert for new or regressed production issues with a 30-minute per-issue cooldown.
+After creating a Sentry Python/FastAPI project, add its DSN as the `sentry_dsn` field in the existing `provider-config` JSON secret. This keeps production at six active Secret Manager versions. Then deploy and configure a Sentry email issue alert for new or regressed production issues with a 30-minute per-issue cooldown.
 
 Provision Google Cloud alerts with:
 

docs/observability.md

@@ -85,7 +85,7 @@ Which signal fires for which failure class:
 
 ### Error tracking
 
-Setting `SENTRY_DSN` enables Sentry for unhandled and selected handled-exception capture (error-capture only — tracing stays with LangSmith/LangFuse, PII and stack-trace locals are not sent). Production uses the Cloud Run revision as the Sentry release. Configure one Sentry issue alert for a new or regressed issue in `production`, delivered by email with a 30-minute per-issue cooldown. See [Production configuration](env-vars-production.md).
+Setting `SENTRY_DSN` locally, or `sentry_dsn` inside the production `PROVIDER_CONFIG_JSON` secret, enables Sentry for unhandled and selected handled-exception capture (error-capture only — tracing stays with LangSmith/LangFuse, PII and stack-trace locals are not sent). Production uses the Cloud Run revision as the Sentry release. Configure one Sentry issue alert for a new or regressed issue in `production`, delivered by email with a 30-minute per-issue cooldown. See [Production configuration](env-vars-production.md).
 
 Handled-exception metadata is allowlisted to operational identifiers such as run, session, job, and outbox event IDs. Prompts, chat messages, documents, tokens, and authorization values are never attached.
 

pyproject.toml

@@ -7,12 +7,12 @@ requires-python = ">=3.11"
 dependencies = [
     "langgraph>=0.2.0",
     "langchain>=0.3.0",
-    "langchain-community>=0.3.0",
+    "langchain-community>=0.4.2",
     "langchain-openai>=0.2.0",
     "langchain-ollama>=0.1.0",
     "tavily-python>=0.5.0",
     "openai>=1.0.0",
-    "fastapi>=0.115.0",
+    "fastapi>=0.139.1",
     "uvicorn[standard]>=0.30.0",
     "slowapi>=0.1.9",
     "sentry-sdk[fastapi]>=2.0",
@@ -31,7 +31,7 @@ dependencies = [
     "inngest>=0.5.18",
     "llama-index-core>=0.12.0",
     "llama-index-embeddings-openai>=0.3.0",
-    "llama-index-embeddings-ollama>=0.3.0",
+    "llama-index-embeddings-ollama>=0.9.0",
     "stripe>=11.0.0",
     "redis>=5.0.0",
     "neo4j>=5.26.0",
@@ -40,7 +40,7 @@ dependencies = [
     "composio-langchain>=0.6.0",
     "langchain-tavily>=0.2.18",
     "arxiv-mcp-server>=0.5.0",
-    "langchain-mcp-adapters>=0.2.2",
+    "langchain-mcp-adapters>=0.3.0",
 ]
 
 [project.optional-dependencies]

scripts/deploy.sh

@@ -53,7 +53,7 @@ gcloud container images add-tag "$TAG" "$LATEST" --quiet
 # ── Deploy ────────────────────────────────────────────────────────────────────
 
 # Inject the SHA-tagged image (and project id) so Cloud Run sees a spec change
-TMP_YAML=$(mktemp /tmp/service-XXXXXX.yaml)
+TMP_YAML=$(mktemp /tmp/service-XXXXXX)
 sed "s|gcr.io/PROJECT_ID/cortex:latest|$TAG|g" "$SERVICE_YAML" > "$TMP_YAML"
 
 if ! grep -q "$TAG" "$TMP_YAML"; then