feat(search): on-demand cosine rerank path behind flag (Phase 2)

[ManSio]

What

Phase 2 of the approved stack migration (E25): score the top-N fused candidates with LIVE embeddings at request time instead of stored vectors + BGE reranker.

• src/core/search/ondemand_rerank.py — pure numpy module: cosine_sims, rerank_by_cosine (stable sort, ties keep fused order), split_embed_inputs (prefers text_full, counts text-less).
• src/config/settings.py — MSCODEBASE_ONDEMAND_RERANK (+ ..._TOP_N, default 10), same field(default_factory=...) pattern as late_enrichment so reload_config() re-reads env.
• src/core/search/engine.py — hook in hybrid_search_async: flag ON -> _apply_ondemand_reranker_async INSTEAD of the BGE reranker (not before it — BGE stays the flag-off path). Any error returns the fused pool unchanged, same contract as the BGE fallback. Tail beyond top-N is appended in original order, total never exceeds limit.
• experiments/search_quality/flagon_check.py — wiring proof artifact (same measuring code as the Phase 0 driver).

Default OFF

Production path is byte-identical without the flag: the branch is entered only when self._ondemand_rerank is true AND the fused pool is non-empty.

Tests

tests/test_ondemand_rerank.py 6/6 — exact math on fake vectors (cosine = 1 / 0 / sqrt(0.5), zero-query safety, stable ties, inputs not mutated, text_full preference), plus flag-default-off wiring assertions. Adjacent suites 36/36, ruff clean.

Live check (flag ON, real embedder)

• quality: hit@1 3/10, hit@5 4/10 — equal to the Phase 0 baseline, no regression.
• _last_rerank_timing = {'mode': 'ondemand_cosine', 'ms': 1041, 'skipped_no_text': 0}.
• fast unchanged (hit@1 0/10, hit@5 6/10 as before).

Clean state

git clone --branch feat/ondemand-rerank + bash scripts/verify_clean_state.sh --no-clone at b8e544af:
Passed: 2049 / Failed: 0 — CLEAN STATE VERIFICATION: PASSED, revision gate VALID, 3/3 negative controls PROVEN.

CI caveat (honest)

The CI workflow triggers only on pull_request: branches: [main] (and push: main). This PR is stacked on #73, so no GitHub CI run is produced — the clean-state run above is the equivalent evidence. The only check reported on the PR is Code scanning AI findings, which failed on an external cause: You have exceeded your monthly quota (HTTP 402) from the Advanced Security action, not on repo code.
Re-targeting this PR to main after #73 merges will produce a normal CI run.

Notes

• Stacked on feat(index): E26 file-level chunk augmentation behind flag (default OFF) #73 (Phase 1). Merge order: fix(search): graceful fast-mode fallback when embedder is down #72 -> feat(index): E26 file-level chunk augmentation behind flag (default OFF) #73 -> this.
• Does not write anything to the index; no reindex required.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: faafb688-dd39-4d8c-91dd-cd28ea158a27

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}