GustoBot Recipe Knowledge Assistant

The README describes multiple data sources, external search, image and file handling, and source-labeled answers. The data lineage note also admits that some historical texts and eight pgvector sample records lack verifiable upstream provenance, so data flows are partly visible but source coverage is incomplete (2). Guardrails, schema checks, and optional Cypher validation are described, but there is no evidence of user confirmation, rollback, or sensitive-data storage and retention controls (0, 0, and 1 respectively). Most dependencies are pinned, but LightRAG has an open version range and no vulnerability response evidence is provided (1). Least-privilege and external side-effect controls are not evidenced (1 each).

README, pyproject.toml, and requirements.txt disagree on Python support (3.10, >=3.9, and mixed dependency declarations); some PostgreSQL fallback descriptions also differ across the architecture narrative, so consistency is partial (1). Docker startup is documented, but the system requires several databases, models, and external APIs, and dependency/configuration availability is not established (1). Test scripts show exception capture or error events, but consistent user-facing recovery guidance is not evidenced (1).

The recipe-support scenario, query classes, multimodal capabilities, and vertical-domain migration idea are described concretely enough for ordinary use assessment (2). Domain boundaries and rejection behavior are described, though implementation evidence for those boundaries is limited (2). Heuristic plus LLM routing and example queries show intended triggers, but thresholds and misrouting handling are absent (1). Python, Node, and Docker requirements are listed, but the Python versions conflict and external-service configuration is incomplete (1).

The README organizes architecture, features, workflows, and setup clearly, though it is lengthy (2). Quick start gives basic commands and an .env reminder but omits required variable and service configuration details (1). Module and route names are illustrated, but version requirements conflict and terminology is mixed in places (1). Feature tables, diagrams, and routing cases are useful examples, though no FAQ is provided (2). Data provenance caveats and the Security Policy support scope describe some limitations (2). The repository includes the full Apache-2.0 license text (3). pyproject has a version and SECURITY.md states branch support, but there is no changelog or release history evidence (1). Security reporting channels and support for the latest develop branch are stated, while author metadata remains placeholder text, limiting clarity about responsibility (1).

The system promises answers, sources, and session history; multi-source retrieval and SQL/graph/multimodal features fit recipe support, but verifiable output-quality evidence is limited (2). Structured queries, graph knowledge, and file/image capabilities offer domain value beyond basic chat, though these remain largely documented claims (2). Deployment needs numerous databases, models, and external APIs, creating notable setup and operating costs without estimates (1).

The README maps many features to modules, tools, and data sources, and discloses data without retained provenance; this gives some traceability, though implementation evidence is limited (2). LICENSE, dependency inventory, test scripts, and security policy corroborate some repository facts, but core capabilities rely mainly on README claims and test files do not establish executed results (1). The provenance note distinguishes sourced data from demo data with missing upstream attribution, while many security features are presented as design descriptions, providing partial separation of fact from claim (2).