Release v3.8.32 (#4418)

Release v3.8.32 — see CHANGELOG.md [3.8.32] for the full list. Merged via --admin over documented non-blocking checks: CodeQL alerts ratchet (#665 fixed by #4457/#4462, auto-closes on main rescan), Integration Tests (env-flaky batch-upstream), SonarCloud/SonarQube (advisory new-code).

.env.example

@@ -1625,6 +1625,12 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # OPENCODE_API_KEY=
 
 # ─── Bifrost Go sidecar (PR-4 in #3932) ──────────────────────────────────────
+# Master kill switch for the bifrost sidecar proxy. When set to 0, the
+# /api/v1/relay/chat/completions/bifrost route returns 503 with the
+# X-Bifrost-Killswitch header and the operator is bounced to the TS path.
+# Use this to disable the sidecar without redeploying (e.g. during a
+# tier-1 router incident or a key rotation). Default: 1 (sidecar active).
+# BIFROST_ENABLED=1
 # When BIFROST_BASE_URL is set, /api/v1/relay/chat/completions/bifrost routes
 # traffic to the Go gateway instead of the TS relay handler, removing TS from
 # the hot path. Auth/rate-limit/injection-guard stay in the route (security not
@@ -1668,3 +1674,30 @@ QUOTA_STORE_DRIVER=sqlite              # sqlite | redis
 # Redis image used by the 1-click Redis launcher. Default: redis:7-alpine.
 # Override to redis:8-alpine or a private registry mirror as needed.
 # OMNIROUTE_REDIS_IMAGE=
+
+# ── Cluster Profile: Qdrant Vector Memory (opt-in via `docker compose --profile memory up`) ──
+# Qdrant is an OPTIONAL sidecar for deployments that need cosine-distance vector
+# search at >1M embeddings. The default vector store is sqlite-vec
+# (src/lib/memory/vectorStore.ts:108); flip this profile on only if you hit the
+# sqlite-vec ceiling or want persistent cross-replica vector state. See
+# docs/architecture/cluster-decisions.md § "Qdrant (memory profile)".
+# QDRANT_HOST=qdrant
+# QDRANT_PORT=6333
+# QDRANT_GRPC_PORT=6334
+# QDRANT_API_KEY=
+# QDRANT_COLLECTION=omniroute-memory
+# QDRANT_EMBEDDING_MODEL=text-embedding-3-small
+# QDRANT_VECTOR_SIZE=1536
+# QDRANT_HNSW_EF_CONSTRUCT=128
+
+# ── Cluster Profile: Bifrost Tier-1 Router (opt-in via `docker compose --profile bifrost up`) ──
+# Bifrost is an OPTIONAL Go-based Tier-1 router that handles the upstream-provider
+# multiplexing layer. Default: OmniRoute's open-sse/executors/bifrost.ts in-process
+# executor handles routing directly. Flip this profile on only if you want the
+# gateway as a separate sidecar (helps in 3+ replica deployments where you want
+# provider rotation centralised). See docs/architecture/cluster-decisions.md §
+# "Bifrost (bifrost profile)".
+# BIFROST_BASE_URL=http://bifrost:8080
+# BIFROST_API_KEY=
+# BIFROST_STREAMING_ENABLED=true
+# BIFROST_TIMEOUT_MS=30000