test(search): compare rankers and measure storage-backed discovery

[leemour]

Keep the search experiments in one synthetic, offline research area and measure the complete lightweight path rather than only ranking manually anchored candidates. Preserve the original transferred fixtures/reports, model explanations, tool research, 23-variant matrix and frozen-feature robustness validation.

Add a model-free question path, fresh authored wording, simple ranking ablations and a build-driven storage-backed discovery benchmark. The frozen planner/BM25/context prototype drops from 92.9% on shared topic templates to 56.3% (9/16) on fresh actual-answer questions. Partial candidate retrieval recovers the missing evidence. The integrated shared service reaches 16/16 in the fresh top ten, 14/16 in the top three and 2/16 at rank one, with MRR@10 0.521 and nDCG@10 0.748. These examples became development cases; they are not blinded or independently human-labeled quality proof.

The older template remains recorded: 48/56 actual answers in the top ten, eight retention-paraphrase ranking failures and 160 partial hits on missing-fact/unknown-qualifier queries. Discovery is evidence retrieval, not an answer-availability detector; the strict default-switch gates remain unmet.

Separate archive ingestion from query RAM by launching fresh Node query processes against marked synthetic databases. The 100,341-message report records about 125 MB query-process peak RSS and about 108 ms question p95 on the measured Ryzen laptop, with no neural weights. Preserve exact question inputs, result ids, build/fixture/runner hashes and launch metadata. The launcher stages only the selected harness and transparently adapts staged core scope/native package aliases after the @wirecat rename, without changing original scripts.

The shared implementation is cli-messaging PR #803; public CLI/MCP strict defaults and SDK compatibility are preserved. This repo publishes no live account data and changes no existing conversation-search benchmark or published suite API.

Validation after rebase: repository lint, types, all 59 tests with coverage and document checks; targeted research Markdown; historical/matrix/validation/model-free harness typechecks; 12 planner tests; built SDK integration/control tests in cli-messaging. Reports retain failures. See performance/search/model-free/FRESH-VALIDATION.md for complete comparison, resources, limitations and reproduction.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​nltk@​3.9.2
	pypi/​certifi@​2026.7.22
	pypi/​numpy@​2.3.5
	pypi/​onnxruntime@​1.23.2
	pypi/​tqdm@​4.70.1
	pypi/​coloredlogs@​15.0.1
	pypi/​humanfriendly@​10.0
	pypi/​scipy@​1.18.1
	pypi/​sympy@​1.14.0
	pypi/​fsspec@​2026.9.0
	pypi/​joblib@​1.6.0
	pypi/​huggingface-hub@​1.33.0
	pypi/​scikit-learn@​1.7.2
	pypi/​click@​8.5.0
	pypi/​anyio@​4.15.1
	pypi/​mpmath@​1.3.0
	pypi/​filelock@​4.0.12
	pypi/​lightgbm@​4.6.0
	pypi/​packaging@​26.3
	pypi/​pyyaml@​6.0.3
	pypi/​typing-extensions@​4.16.0
	pypi/​tokenizers@​0.22.1
	pypi/​threadpoolctl@​3.7.0
	pypi/​httpcore@​1.0.9
	pypi/​regex@​2026.9.29
	pypi/​cloudpickle@​3.1.2
	pypi/​hf-xet@​1.7.0
	pypi/​h11@​0.16.0
	pypi/​flatbuffers@​25.12.19
	pypi/​httpx@​0.28.1
	pypi/​protobuf@​7.36.2
	pypi/​idna@​3.20

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Critical CVE: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution CVE: GHSA-rhp5-r9x4-f5g2 NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution (CRITICAL) Affected versions: < 3.10.0 Patched version: 3.10.0 From: performance/search/matrix/requirements.lock → pypi/nltk@3.9.2 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/nltk@3.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: NLTK: Allowlisted pickle loaders still permit code execution in current source CVE: GHSA-x99w-6fgc-pmfw NLTK: Allowlisted pickle loaders still permit code execution in current source (CRITICAL) Affected versions: < 3.10.3 Patched version: 3.10.3 From: performance/search/matrix/requirements.lock → pypi/nltk@3.9.2 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/nltk@3.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: NLTK has a Zip Slip Vulnerability CVE: GHSA-7p94-766c-hgjp NLTK has a Zip Slip Vulnerability (CRITICAL) Affected versions: < 3.9.3 Patched version: 3.9.3 From: performance/search/matrix/requirements.lock → pypi/nltk@3.9.2 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/nltk@3.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Critical CVE: NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) CVE: GHSA-m4rf-3fr8-xwx3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) (CRITICAL) Affected versions: < 3.10.3 Patched version: 3.10.3 From: performance/search/matrix/requirements.lock → pypi/nltk@3.9.2 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore pypi/nltk@3.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report