Harden FlashRank reranking (review-driven) and wire it into the image

Adversarial multi-agent review follow-up to the second-stage reranker:
- answering.py: pool_k = max(TOP_K, RERANK_CANDIDATES) so a mis-set
RERANK_CANDIDATES can never shrink the abstention gate's top-K (the
abstention decision stays provably on the TF-IDF top-K).
- reranking.py: guard the one-time, network-bound ranker construction with a
double-checked threading.Lock — concurrent first /ask requests no longer
race into two parallel model downloads; bounds-check the result->chunk
remap so a changed flashrank result schema can't IndexError.
- Dockerfile: flashrank ships via requirements.txt; keep the optional LLM
SDKs (openai/anthropic) explicit.

Verified: 28 tests pass; golden eval unchanged (7/7, 100% citation coverage,
0 unsupported, evidence-match 1.0); proved enabled-without-flashrank cites the
identical set as a no-rerank build, so abstention and eval are preserved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Dockerfile

@@ -16,7 +16,8 @@ FROM python:3.12-slim
 WORKDIR /app
 
 COPY backend/requirements.txt ./requirements.txt
-# Include the optional LLM SDKs so "Thinking" mode works when a key is provided.
+# requirements.txt already pins flashrank (the reranker). Add the optional LLM
+# SDKs too so "Thinking" mode works when a key is provided.
 RUN pip install --no-cache-dir -r requirements.txt openai anthropic
 
 COPY backend/app ./app

backend/app/answering.py

@@ -107,11 +107,19 @@ def answer_question(question: str, chunks: List[Chunk], mode: str = "fast"):
                        or the call fails. The returned mode reflects what actually
                        produced the answer ("fast" | "thinking").
     """
-    # Stage 1: TF-IDF retrieval. Pull a larger candidate pool when reranking is
-    # on, but the abstention DECISION below always uses the original top-K, so the
-    # behaviour (and the golden eval) is identical whether or not the reranker is
-    # present.
-    pool_k = config.RERANK_CANDIDATES if reranking.is_enabled() else config.TOP_K
+    # Stage 1: TF-IDF retrieval. Pull a larger candidate pool when reranking is on.
+    # The abstention DECISION (below) always runs on the original top-K TF-IDF
+    # scores, so it is identical with or without reranking — as are citation
+    # coverage and the unsupported-answer count. Reranking only reorders/selects
+    # WHICH evidence is cited (by design the cross-encoder may promote a chunk
+    # ranked outside the top-K); when flashrank is absent the cited set is the same
+    # top-K TF-IDF slice as a no-rerank build. max() keeps the gate's top-K intact
+    # even if RERANK_CANDIDATES is mis-set below TOP_K.
+    pool_k = (
+        max(config.TOP_K, config.RERANK_CANDIDATES)
+        if reranking.is_enabled()
+        else config.TOP_K
+    )
     scored = rank_chunks(question, chunks, top_k=pool_k)
     gate_chunks = scored[: config.TOP_K]
     top_score = gate_chunks[0].score if gate_chunks else 0.0

backend/app/reranking.py

@@ -13,6 +13,7 @@ only reorders the evidence that gets cited and fed to the LLM; the abstention
 decision still runs on the TF-IDF scores in answering.py.
 """
 import logging
+import threading
 from typing import List
 
 from . import config
@@ -22,6 +23,7 @@ logger = logging.getLogger(__name__)
 
 _ranker = None          # cached FlashRank Ranker instance
 _unavailable = False    # latch: once we know it's unusable, stop retrying
+_lock = threading.Lock()  # guards the one-time, network-bound ranker construction
 
 
 def is_enabled() -> bool:
@@ -29,22 +31,31 @@ def is_enabled() -> bool:
 
 
 def _get_ranker():
-    """Lazily build and cache the FlashRank ranker, or return None if unusable."""
+    """Lazily build and cache the FlashRank ranker, or return None if unusable.
+
+    Construction downloads a small model on first use; FastAPI serves /ask from a
+    threadpool, so the check-then-set is guarded by a lock (double-checked) to stop
+    concurrent first requests from racing into two parallel downloads.
+    """
     global _ranker, _unavailable
     if _ranker is not None:
         return _ranker
     if _unavailable:
         return None
-    try:
-        from flashrank import Ranker  # optional dependency, imported lazily
+    with _lock:
+        if _ranker is not None:
+            return _ranker
+        if _unavailable:
+            return None
+        try:
+            from flashrank import Ranker  # optional dependency, imported lazily
 
-        _ranker = Ranker(model_name=config.RERANK_MODEL)
-        logger.info("Reranker ready (%s).", config.RERANK_MODEL)
-        return _ranker
-    except Exception as exc:  # not installed / download failed / offline
-        logger.info("Reranker unavailable (%s); using TF-IDF order.", exc)
-        _unavailable = True
-        return None
+            _ranker = Ranker(model_name=config.RERANK_MODEL)
+            logger.info("Reranker ready (%s).", config.RERANK_MODEL)
+        except Exception as exc:  # not installed / download failed / offline
+            logger.info("Reranker unavailable (%s); using TF-IDF order.", exc)
+            _unavailable = True
+    return _ranker
 
 
 def rerank(question: str, scored: List[ScoredChunk], top_k: int) -> List[ScoredChunk]:
@@ -62,9 +73,17 @@ def rerank(question: str, scored: List[ScoredChunk], top_k: int) -> List[ScoredC
     try:
         from flashrank import RerankRequest
 
+        # flashrank scores then sorts the passages list IN PLACE, so build a fresh
+        # list every call (never cache it). Each result keeps the "id" we set here.
         passages = [{"id": i, "text": s.chunk.text} for i, s in enumerate(scored)]
         ranked = ranker.rerank(RerankRequest(query=question, passages=passages))
-        return [scored[r["id"]] for r in ranked][:top_k]
+        # Bounds-checked remap so a changed result schema can't IndexError/KeyError.
+        out = [
+            scored[i]
+            for r in ranked
+            if isinstance((i := r.get("id")), int) and 0 <= i < len(scored)
+        ]
+        return (out or head)[:top_k]
     except Exception as exc:  # pragma: no cover - defensive
         logger.warning("Rerank failed (%s); using TF-IDF order.", exc)
         return head