everything-gemini 1.8.0 → 1.9.0

package/examples/python-sdk/platform_provisioning_pipeline.py

@@ -0,0 +1,193 @@
+#!/usr/bin/env python3
+"""
+Everything Gemini (everything-gemini) Python SDK Example
+Cloud Platform Provisioning & Zero-Trust Infrastructure Pipeline
+
+Orchestrates a 4-stage automated cloud delivery loop:
+Architect -> Platform Engineer -> Security Auditor -> Release Engineer
+"""
+
+import sys
+import json
+from dataclasses import dataclass, field
+from typing import List, Dict, Any, Optional
+
+@dataclass
+class PlatformWorkloadRequest:
+    workload_id: str
+    environment: str  # staging, production
+    cloud_provider: str  # gcp, aws, azure
+    cluster_region: str
+    expected_qps: int
+    data_retention_days: int
+    services: List[str] = field(default_factory=list)
+    compliance_frameworks: List[str] = field(default_factory=list)
+
+class PlatformProvisioningPipeline:
+    """Automates multi-agent cloud platform provisioning and compliance auditing."""
+
+    def __init__(self, request: PlatformWorkloadRequest):
+        self.request = request
+        self.audit_trail: List[Dict[str, Any]] = []
+        self.iac_manifests: Dict[str, str] = {}
+        self.security_clearance: bool = False
+        self.deployment_ready: bool = False
+
+    def log_event(self, agent: str, phase: str, status: str, details: str):
+        event = {
+            "agent": agent,
+            "phase": phase,
+            "status": status,
+            "details": details
+        }
+        self.audit_trail.append(event)
+        print(f"[{agent.upper()}] ({phase}): {status} - {details}")
+
+    def stage_1_architecture_blueprint(self) -> bool:
+        """Stage 1: Architect subagent designs high-availability topology and VPC segmentation."""
+        self.log_event(
+            agent="architect",
+            phase="topology_design",
+            status="DESIGNED",
+            details=f"Designed multi-zone VPC topology in {self.request.cluster_region} for {len(self.request.services)} services."
+        )
+
+        # Architectural scaling rules
+        if self.request.expected_qps > 5000:
+            topology = "multi-region-active-active"
+        else:
+            topology = "multi-zone-ha-regional"
+
+        self.log_event(
+            agent="architect",
+            phase="scaling_strategy",
+            status="CONFIRMED",
+            details=f"Selected topology: {topology} with horizontal pod autoscaling (HPA) target 75% CPU."
+        )
+        return True
+
+    def stage_2_platform_provisioning(self) -> bool:
+        """Stage 2: Platform Engineer generates Terraform/Helm modules and sizes compute resources."""
+        self.log_event(
+            agent="platform-engineer",
+            phase="iac_generation",
+            status="GENERATED",
+            details="Generated Terraform modules for GKE/EKS cluster, node pools, and VPC CNI."
+        )
+
+        # Resource right-sizing
+        cpu_request = "500m" if self.request.expected_qps < 1000 else "2000m"
+        ram_request = "1Gi" if self.request.expected_qps < 1000 else "4Gi"
+        
+        self.iac_manifests["helm_values"] = f"""
+replicaCount: 3
+resources:
+  requests:
+    cpu: {cpu_request}
+    memory: {ram_request}
+  limits:
+    cpu: {cpu_request}
+    memory: {ram_request}
+autoscaling:
+  enabled: true
+  minReplicas: 3
+  maxReplicas: 20
+  targetCPUUtilizationPercentage: 75
+"""
+        self.log_event(
+            agent="platform-engineer",
+            phase="resource_sizing",
+            status="OPTIMIZED",
+            details=f"Container resource requests sized to {cpu_request} CPU, {ram_request} RAM per pod."
+        )
+        return True
+
+    def stage_3_security_and_compliance_gate(self) -> bool:
+        """Stage 3: Security Auditor validates zero-trust network policies, RBAC, and Vault secrets."""
+        self.log_event(
+            agent="security-auditor",
+            phase="policy_scan",
+            status="INSPECTING",
+            details=f"Scanning against compliance standards: {', '.join(self.request.compliance_frameworks)}."
+        )
+
+        # Check for zero-trust network boundaries
+        has_ebpf_mtls = True
+        has_ephemeral_secrets = True
+
+        if has_ebpf_mtls and has_ephemeral_secrets:
+            self.security_clearance = True
+            self.log_event(
+                agent="security-auditor",
+                phase="zero_trust_verification",
+                status="APPROVED",
+                details="Zero-trust CiliumNetworkPolicy, Workload Identity, and Vault AppRole verified with zero findings."
+            )
+            return True
+        else:
+            self.log_event(
+                agent="security-auditor",
+                phase="zero_trust_verification",
+                status="REJECTED",
+                details="Missing automated mTLS or ephemeral secret rotation."
+            )
+            return False
+
+    def stage_4_release_and_canary_plan(self) -> bool:
+        """Stage 4: Release Engineer compiles progressive delivery plan and automated rollback triggers."""
+        if not self.security_clearance:
+            print("[RELEASE-ENGINEER] Blocked: Security clearance not granted.")
+            return False
+
+        self.log_event(
+            agent="release-engineer",
+            phase="canary_orchestration",
+            status="SCHEDULED",
+            details="Formulated 5% -> 25% -> 100% canary rollout with automated rollback on error rate > 0.5%."
+        )
+        self.deployment_ready = True
+        return True
+
+    def execute(self) -> Dict[str, Any]:
+        """Execute full platform delivery pipeline."""
+        print(f"\n🚀 Initiating Platform Provisioning Pipeline for '{self.request.workload_id}' ({self.request.environment})...\n")
+        
+        ok = self.stage_1_architecture_blueprint()
+        if ok:
+            ok = self.stage_2_platform_provisioning()
+        if ok:
+            ok = self.stage_3_security_and_compliance_gate()
+        if ok:
+            ok = self.stage_4_release_and_canary_plan()
+
+        report = {
+            "workload_id": self.request.workload_id,
+            "environment": self.request.environment,
+            "cloud_provider": self.request.cloud_provider,
+            "security_clearance": self.security_clearance,
+            "deployment_ready": self.deployment_ready,
+            "audit_trail_events": len(self.audit_trail),
+            "status": "APPROVED" if self.deployment_ready else "BLOCKED"
+        }
+        
+        print(f"\n✨ Platform Provisioning Pipeline Complete: Status = {report['status']}")
+        return report
+
+def main():
+    sample_request = PlatformWorkloadRequest(
+        workload_id="ai-vector-search-cluster",
+        environment="production",
+        cloud_provider="gcp",
+        cluster_region="us-central1",
+        expected_qps=8500,
+        data_retention_days=90,
+        services=["vector-ingestion", "milvus-cluster", "query-gateway"],
+        compliance_frameworks=["SOC2-Type2", "ISO-27001"]
+    )
+
+    pipeline = PlatformProvisioningPipeline(sample_request)
+    report = pipeline.execute()
+    print("\n" + json.dumps(report, indent=2))
+
+if __name__ == "__main__":
+    main()

package/mcp/README.md

@@ -55,6 +55,7 @@ Everything Gemini bundles ready-to-use blueprints in `mcp/mcp_config.example.jso
 | **`filesystem`** | `@modelcontextprotocol/server-filesystem` | Direct multi-directory filesystem inspection | Stdio |
 | **`sentry`** | `@modelcontextprotocol/server-sentry` | Real-time production error tracking, issue triage, and stacktrace analysis | Stdio |
 | **`slack`** | `@modelcontextprotocol/server-slack` | Automated incident channels, alert broadcasts, and team collaboration | Stdio |
+| **`puppeteer`** | `@modelcontextprotocol/server-puppeteer` | Headless browser automation, screenshot diffing, and dynamic web crawling | Stdio |
 
 ## Tool Auto-Discovery & Execution
 Once connected, tools declared by MCP servers are automatically injected into the agent's system prompt and executed through Antigravity's Language Server. Inspect active MCP servers in the Antigravity UI via **Additional Options (...) > MCP Servers**.

package/mcp/mcp_config.example.json

@@ -60,6 +60,10 @@
         "SLACK_BOT_TOKEN": "YOUR_SLACK_BOT_TOKEN",
         "SLACK_TEAM_ID": "YOUR_SLACK_TEAM_ID"
       }
+    },
+    "puppeteer": {
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-puppeteer"]
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "everything-gemini",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "Everything Gemini (everything-gemini) - The Ultimate Agent Harness, Multi-Agent Orchestrator & Performance Suite for Gemini & Google Antigravity",
   "main": "bin/everything-gemini",
   "bin": {

package/scripts/validate.sh

@@ -149,7 +149,7 @@ if [ -f "$REPO_ROOT/tests/cli.test.js" ]; then
     echo "    ❌ ERROR: CLI test suite failed."
     ERRORS=$((ERRORS + 1))
   else
-    echo "    ✔ CLI test suite passed (26 assertions)"
+    echo "    ✔ CLI test suite passed (29 assertions)"
   fi
 fi
 

package/skills/cloudflare-r2-object-storage/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: cloudflare-r2-object-storage
+description: >-
+  Architects, configures, and integrates Cloudflare R2 zero-egress object storage using S3-compatible APIs, pre-signed upload URLs, multipart streaming, and edge CDN distribution.
+---
+
+# Cloudflare R2 Object Storage & Edge Distribution
+
+This skill guides the implementation of zero-egress fee object storage using Cloudflare R2 with S3-compatible APIs, pre-signed URLs, multipart uploads, and edge CDN distribution.
+
+---
+
+## ⚡ Architectural Comparison: R2 vs Standard S3
+
+| Feature | Cloudflare R2 | Standard AWS S3 |
+| :--- | :--- | :--- |
+| **Data Egress Fees** | **$0.00 / GB (Free)** | ~$0.09 / GB |
+| **API Compatibility** | Full S3 API v4 signature | Native AWS S3 |
+| **Edge Integration** | Native Cloudflare Workers & CDN | CloudFront integration required |
+| **Storage Pricing** | $0.015 / GB-month | $0.023 / GB-month |
+| **Global Replication** | Automatic across edge locations | Cross-Region Replication (CRR) billed |
+
+---
+
+## 🛠️ TypeScript S3 Client Configuration (`@aws-sdk/client-s3`)
+
+R2 endpoints use account-specific URLs with AWS Signature Version 4:
+
+```typescript
+import { S3Client, PutObjectCommand, GetObjectCommand } from '@aws-sdk/client-s3';
+import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+
+const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID!;
+const R2_ACCESS_KEY_ID = process.env.R2_ACCESS_KEY_ID!;
+const R2_SECRET_ACCESS_KEY = process.env.R2_SECRET_ACCESS_KEY!;
+
+export const r2Client = new S3Client({
+  region: 'auto',
+  endpoint: `https://${ACCOUNT_ID}.r2.cloudflarestorage.com`,
+  credentials: {
+    accessKeyId: R2_ACCESS_KEY_ID,
+    secretAccessKey: R2_SECRET_ACCESS_KEY,
+  },
+});
+```
+
+---
+
+## 📤 Pre-Signed URLs for Direct Browser Uploads
+
+Prevent API server bottlenecking by generating short-lived pre-signed upload URLs:
+
+```typescript
+export async function generateUploadUrl(key: string, contentType: string, expiresInSeconds = 300) {
+  const command = new PutObjectCommand({
+    Bucket: 'enterprise-artifacts',
+    Key: key,
+    ContentType: contentType,
+  });
+
+  const uploadUrl = await getSignedUrl(r2Client, command, { expiresIn: expiresInSeconds });
+  return {
+    uploadUrl,
+    key,
+    publicUrl: `https://cdn.example.com/${key}`,
+  };
+}
+```
+
+---
+
+## 📦 High-Throughput Multipart Uploads (Node.js / Python)
+
+For files exceeding 100MB, use parallel multipart uploads with the Upload helper:
+
+```typescript
+import { Upload } from '@aws-sdk/lib-storage';
+import fs from 'node:fs';
+
+export async function uploadLargeArchive(filePath: string, destinationKey: string) {
+  const fileStream = fs.createReadStream(filePath);
+  
+  const parallelUpload = new Upload({
+    client: r2Client,
+    params: {
+      Bucket: 'enterprise-artifacts',
+      Key: destinationKey,
+      Body: fileStream,
+      ContentType: 'application/octet-stream',
+    },
+    queueSize: 4,          // 4 concurrent part uploads
+    partSize: 10 * 1024 * 1024, // 10MB chunk size
+    leavePartsOnError: false,
+  });
+
+  parallelUpload.on('httpUploadProgress', (progress) => {
+    console.log(`Uploaded ${progress.loaded} of ${progress.total} bytes`);
+  });
+
+  return await parallelUpload.done();
+}
+```
+
+---
+
+## 🌐 Custom Domain & Cloudflare CDN Caching Rule
+
+Expose R2 buckets through a custom domain with edge cache headers:
+
+```javascript
+// Cloudflare Worker Edge Proxy
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const key = url.pathname.slice(1);
+
+    if (request.method !== 'GET') {
+      return new Response('Method Not Allowed', { status: 405 });
+    }
+
+    const object = await env.MY_R2_BUCKET.get(key);
+    if (!object) {
+      return new Response('Not Found', { status: 404 });
+    }
+
+    const headers = new Headers();
+    object.writeHttpMetadata(headers);
+    headers.set('etag', object.httpEtag);
+    headers.set('Cache-Control', 'public, max-age=31536000, immutable');
+
+    return new Response(object.body, { headers });
+  },
+};
+```
+
+---
+
+## 📋 Architectural Rules & Best Practices
+
+1. **Bucket Region**: Always set region to `auto` in AWS S3 SDK clients; R2 automatically routes storage to the lowest-latency regional cluster.
+2. **CORS Headers**: Set permissive CORS rules (`AllowedOrigins`, `AllowedMethods: ["PUT", "GET"]`) on the R2 bucket for direct browser pre-signed uploads.
+3. **Multipart Cleanup**: Configure bucket lifecycle rules to automatically abort incomplete multipart uploads after 7 days (`AbortIncompleteMultipartUpload`).
+4. **Zero-Egress Strategy**: Route public media and file downloads through Cloudflare Custom Domains or Workers to benefit from zero bandwidth charges.

package/skills/distributed-rate-limiting/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: distributed-rate-limiting
+description: >-
+  Architects, implements, and tunes distributed rate limiting using Redis sliding window logs, token buckets, tiered API quotas, RFC 6585 headers, and circuit breakers.
+---
+
+# Distributed Rate Limiting & API Traffic Shaping
+
+This skill guides the design, implementation, and tuning of distributed rate limiting systems across microservice clusters using Redis, token buckets, and sliding window algorithms.
+
+---
+
+## ⚡ Algorithm Comparison Matrix
+
+| Algorithm | Precision | Memory Usage | Burst Handling | Best For |
+| :--- | :--- | :--- | :--- | :--- |
+| **`Sliding Window Log`** | 100% Exact | High ($O(N)$ requests) | Excellent | Low-to-medium traffic sensitive endpoints (auth, payments). |
+| **`Sliding Window Counter`**| ~99% Exact | Fixed ($O(1)$) | Smooth | High-scale public APIs and ingress gateways. |
+| **`Token Bucket`** | High | Very Low ($O(1)$) | Controlled bursts | Standard microservice backpressuring and rate smoothing. |
+| **`Fixed Window`** | Poor (2x burst at boundary) | Lowest | Prone to spikes | Simple non-critical background jobs only. |
+
+---
+
+## 🔒 Atomic Sliding Window Rate Limiter (Redis Lua)
+
+Atomic execution in Redis ensures no race conditions across distributed API instances:
+
+```lua
+-- sliding_window.lua
+-- KEYS[1]: Rate limit key (e.g., "ratelimit:tenant_123:orders")
+-- ARGV[1]: Current UNIX timestamp in milliseconds
+-- ARGV[2]: Window size in milliseconds (e.g., 60000 for 1 minute)
+-- ARGV[3]: Maximum allowed requests in window (e.g., 100)
+
+local key = KEYS[1]
+local now = tonumber(ARGV[1])
+local window = tonumber(ARGV[2])
+local limit = tonumber(ARGV[3])
+local clearBefore = now - window
+
+-- 1. Remove expired request timestamps outside the window
+redis.call('ZREMRANGEBYSCORE', key, 0, clearBefore)
+
+-- 2. Count requests currently in the sliding window
+local currentRequests = redis.call('ZCARD', key)
+
+if currentRequests < limit then
+    -- 3. Register current request with unique timestamp as score and member
+    redis.call('ZADD', key, now, now .. '-' .. math.random(1000, 9999))
+    redis.call('PEXPIRE', key, window)
+    return { 1, limit - currentRequests - 1, 0 } -- [Allowed: 1, Remaining, RetryAfter: 0]
+else
+    -- 4. Calculate time until oldest entry expires
+    local oldest = redis.call('ZRANGE', key, 0, 0, 'WITHSCORES')
+    local retryAfter = math.ceil((tonumber(oldest[2]) + window - now) / 1000)
+    return { 0, 0, math.max(1, retryAfter) }      -- [Allowed: 0, Remaining: 0, RetryAfter]
+end
+```
+
+---
+
+## 🌐 Express / Fastify / Node.js Middleware Implementation
+
+Wrap Redis Lua execution into production middleware with RFC 6585 compliance:
+
+```typescript
+import { Request, Response, NextFunction } from 'express';
+import Redis from 'ioredis';
+
+const redis = new Redis(process.env.REDIS_URL || 'redis://localhost:6379');
+
+export function createRateLimiter(options: { windowMs: number; max: number; keyGenerator?: (req: Request) => string }) {
+  return async (req: Request, res: Response, next: NextFunction) => {
+    const key = options.keyGenerator ? options.keyGenerator(req) : `ratelimit:${req.ip}`;
+    const now = Date.now();
+
+    try {
+      const [allowed, remaining, retryAfter] = await redis.eval(
+        SLIDING_WINDOW_LUA_SCRIPT,
+        1,
+        key,
+        now.toString(),
+        options.windowMs.toString(),
+        options.max.toString()
+      ) as [number, number, number];
+
+      // Set standard RFC 6585 RateLimit response headers
+      res.setHeader('X-RateLimit-Limit', options.max);
+      res.setHeader('X-RateLimit-Remaining', remaining);
+      res.setHeader('X-RateLimit-Reset', Math.ceil((now + options.windowMs) / 1000));
+
+      if (allowed === 1) {
+        return next();
+      }
+
+      res.setHeader('Retry-After', retryAfter);
+      return res.status(429).json({
+        error: 'Too Many Requests',
+        message: `Rate limit exceeded. Please retry after ${retryAfter} seconds.`,
+        retryAfter,
+      });
+    } catch (err) {
+      // Circuit Breaker: Fail-Open for high availability if Redis degrades
+      console.error('RateLimiter Redis failure, failing open:', err);
+      return next();
+    }
+  };
+}
+```
+
+---
+
+## 🎯 Tiered Multi-Dimensional Quotas
+
+Configure tiered rate limits based on authenticated API keys and endpoint criticality:
+
+```typescript
+export function getTierLimits(tier: 'free' | 'pro' | 'enterprise') {
+  switch (tier) {
+    case 'enterprise':
+      return { windowMs: 60_000, max: 10_000 };
+    case 'pro':
+      return { windowMs: 60_000, max: 1_200 };
+    case 'free':
+    default:
+      return { windowMs: 60_000, max: 60 };
+  }
+}
+```
+
+---
+
+## 📋 Architectural Rules & Best Practices
+
+1. **Atomic Scripts**: Never implement rate limiters with separated `GET` and `INCR` commands; always execute atomic Lua scripts or Redis Transactions (`MULTI/EXEC`) to prevent race conditions under load.
+2. **Fail-Open Strategy**: For user-facing critical flows, catch Redis connection timeouts and fail-open with alerting rather than causing total service outages.
+3. **Multi-Dimensional Keys**: Combine client identity with endpoint routes (e.g. `tenant:123:POST:/api/v1/checkout`) to prevent denial of service on high-cost endpoints.
+4. **Header Standards**: Always emit `Retry-After`, `X-RateLimit-Limit`, and `X-RateLimit-Remaining` to allow compliant clients to back off exponentially.

package/skills/milvus-vector-clustering/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: milvus-vector-clustering
+description: >-
+  Architects, scales, and optimizes Milvus distributed vector databases, HNSW/IVF-PQ indexing, hybrid dense-sparse search, dynamic schema partition keys, and scalar metadata filtering.
+---
+
+# Milvus Vector Clustering & Distributed Similarity Search
+
+This skill guides the design, indexing, and high-throughput querying of enterprise-scale vector collections using Milvus and Zilliz Cloud.
+
+---
+
+## ⚡ Indexing Selection Matrix
+
+| Index Type | Search Latency | Recall Rate | Memory Footprint | Best For |
+| :--- | :--- | :--- | :--- | :--- |
+| **`HNSW`** | Ultra-low (<5ms) | High (>98%) | High (in-memory graph) | Mission-critical search where latency is top priority. |
+| **`IVF_FLAT`** | Medium (10-30ms) | Tunable (nprobe) | Moderate | Standard baseline for medium datasets (<10M vectors). |
+| **`IVF_PQ`** | Low (5-15ms) | Moderate (85-92%) | Very Low (quantized) | Massive scale (100M+ vectors) with tight RAM budgets. |
+| **`SCANN`** | Very Low (<8ms) | High (>95%) | Moderate | High-dimensional CPU-accelerated similarity search. |
+| **`SPARSE_INVERTED_INDEX`**| Ultra-low | Exact / BM25 | Low | Sparse lexical vectors (SPLADE, BM25 hybrid ranking). |
+
+---
+
+## 🏗️ Production Collection Schema with Partition Keys
+
+Multi-tenant applications should leverage Milvus **Partition Keys** to isolate tenant data logically without exceeding physical partition limits:
+
+```python
+from pymilvus import (
+    connections, FieldSchema, CollectionSchema, DataType,
+    Collection, utility
+)
+
+# Connect to Milvus Cluster / Standalone
+connections.connect(alias="default", host="localhost", port="19530")
+
+fields = [
+    # Primary Key
+    FieldSchema(name="doc_id", dtype=DataType.VARCHAR, max_length=128, is_primary=True, auto_id=False),
+    
+    # Multi-tenant Partition Key (routes queries to physical partition clusters)
+    FieldSchema(name="tenant_id", dtype=DataType.VARCHAR, max_length=64, is_partition_key=True),
+    
+    # Scalar Metadata for Pre-filtering
+    FieldSchema(name="category", dtype=DataType.VARCHAR, max_length=64),
+    FieldSchema(name="created_at", dtype=DataType.INT64),
+    FieldSchema(name="is_archived", dtype=DataType.BOOL),
+    
+    # Dense Vector Embedding (e.g., text-embedding-004, 768 dimensions)
+    FieldSchema(name="dense_vector", dtype=DataType.FLOAT_VECTOR, dim=768),
+    
+    # Sparse Lexical Vector (e.g., SPLADE or BM25 tokens)
+    FieldSchema(name="sparse_vector", dtype=DataType.SPARSE_FLOAT_VECTOR),
+]
+
+schema = CollectionSchema(fields=fields, description="Enterprise Knowledge Base Vectors", enable_dynamic_field=True)
+collection = Collection(name="knowledge_embeddings", schema=schema)
+```
+
+---
+
+## 🔍 Building Vector Indexes
+
+Build indexes before loading the collection into memory:
+
+```python
+# 1. Dense Vector Index (HNSW for high recall & low latency)
+dense_index_params = {
+    "metric_type": "COSINE",
+    "index_type": "HNSW",
+    "params": {
+        "M": 16,               # Max outgoing links per node (16-64)
+        "efConstruction": 200  # Exploration factor during index build
+    }
+}
+collection.create_index(field_name="dense_vector", index_params=dense_index_params)
+
+# 2. Sparse Vector Index
+sparse_index_params = {
+    "metric_type": "IP",       # Inner Product for sparse lexical weights
+    "index_type": "SPARSE_INVERTED_INDEX",
+    "params": {"drop_ratio_build": 0.2}
+}
+collection.create_index(field_name="sparse_vector", index_params=sparse_index_params)
+
+# Load into query nodes
+collection.load()
+```
+
+---
+
+## 🚀 Hybrid Search with Reciprocal Rank Fusion (RRF)
+
+Combine dense semantic search with sparse lexical matching for optimal recall:
+
+```python
+from pymilvus import AnnSearchRequest, RRFRanker
+
+# Dense vector query request
+dense_req = AnnSearchRequest(
+    data=[query_dense_embedding],
+    anns_field="dense_vector",
+    param={"metric_type": "COSINE", "params": {"ef": 64}},
+    limit=50,
+    expr='tenant_id == "org_acme" and is_archived == false'
+)
+
+# Sparse vector query request
+sparse_req = AnnSearchRequest(
+    data=[query_sparse_dict],
+    anns_field="sparse_vector",
+    param={"metric_type": "IP", "params": {"drop_ratio_search": 0.1}},
+    limit=50,
+    expr='tenant_id == "org_acme" and is_archived == false'
+)
+
+# Execute hybrid search with RRF reranking
+results = collection.hybrid_search(
+    reqs=[dense_req, sparse_req],
+    rerank=RRFRanker(k=60),
+    limit=10,
+    output_fields=["doc_id", "category", "created_at"]
+)
+```
+
+---
+
+## 📋 Architectural Rules & Best Practices
+
+1. **Partition Key Limits**: Use `is_partition_key=True` for tenant routing; Milvus maps millions of logical tenants into ~64-256 physical partition clusters automatically.
+2. **Pre-Filtering Optimization**: Place high-selectivity scalar filters (`expr='category == "tech"'`) directly in the ANN search request to prune candidate sets before graph traversal.
+3. **Compaction Management**: Call `collection.compact()` after bulk insertions or deletions to merge small segment files and purge deleted entity tombstones.
+4. **Memory Sizing**: For HNSW, allocate approximately `(dim * 4 + M * 8) * num_vectors` bytes of RAM on QueryNodes.