[repfly]

Summary

Gets the repo installable, testable and buildable again, and cuts the dependency footprint substantially.

	Before	After
Installed Python packages	~1.4 GB	242 MB
Docker cold build	40+ min	~1 min
Docker image	3.24 GB	1.53 GB
pip-audit	5 chromadb advisories	no known vulnerabilities

Dependencies

• All floors bumped to current releases. numpy and networkx are capped at their last Python 3.11-compatible versions. huggingface-hub stays on 1.x because current tokenizers requires <2.0.
• torch / sentence-transformers → ONNX Runtime. LocalEmbedder now loads the onnx/model.onnx export that sentence-transformers model repos ship, and reproduces pooling and normalization from the repo's own modules.json / 1_Pooling/config.json. The vectors match sentence-transformers to cosine 1.000000 (max element diff ~1e-7), so existing graph.db embeddings stay valid. This also fixes the default jina-embeddings-v2-base-code model, whose torch path no longer imports under transformers 5.
• chroma removed. The in-memory numpy store, rebuilt from graph.db on startup, is now the only backend. I also fixed its quadratic upsert (100k vectors: ~15 min → 1.3 s) and vectorized metadata filtering (search over 100k vectors takes ~4 ms). Configs that still contain [vector_db] keep loading; the section is ignored.
• LLM code removed: the litellm client, the LlmClient port and the [llm] config. Summarization is heuristic-only.
• Unused deps dropped: mcp (the MCP server hand-rolls JSON-RPC), pydantic-settings, tiktoken, direct tree-sitter, tomli (stdlib tomllib), and the unused lsp extra.
• License metadata switched to the SPDX form; the table form stops building on 2027-02-18.

CI / release

• ci.yml: only tests (Python 3.11/3.12/3.13) and build verification (python -m build for both packages + twine check --strict), on PRs and on pushes to main/develop. The guardrail job is removed.
• publish.yml: still triggered by v* tags only. It now runs tests first, runs twine check, and creates the GitHub Release only after both PyPI publishes succeed.
• Actions bumped to their current majors.

Docker

• The image build failed: setuptools-scm had no git metadata and README.md wasn't copied. The version now comes from --build-arg MIMIR_VERSION=....
• The entrypoint called the removed mimir index / mimir serve commands, so the container exited on start. It now uses mimir indexer run / mimir query serve.
• Python 3.13 base, no compiler toolchain, dependency and model layers cached ahead of the source code, and a new .dockerignore. A code-only rebuild takes seconds.

Also fixed

• 4 tests in test_runtime_publish_query.py failed on develop with current aiohttp (3.14 calls resume_reading() on the mocked protocol).

Testing

• pytest: 255 passed (fresh venv, Python 3.13).
• Smoke-tested indexer run, query status/search, the MCP stdio server (initialize, tools/list, tools/call) and the HTTP API.
• Docker: image builds; in auto mode the container indexes, publishes a version and serves /api/v1/health. It embeds with --network none using the pre-baked model.
• Both packages build with no warnings and pass twine check --strict.

Tradeoff

On macOS, full indexing is ~2x slower than torch (this repo: ~99 s), because torch used Apple's Accelerate math libraries. On Linux/Docker, ONNX is slightly faster than torch CPU. Incremental indexing only re-embeds changed code.

Follow-ups (not in this PR)

• docs/how-it-works.md still references mimir quality, which develop's CLI no longer has.
• .mimir/project/graph.db-shm / -wal are tracked in git, and .mimir/indexes/ isn't ignored. The committed graph.db also predates develop's versioned index layout, so it's worth deciding how that file should be refreshed.