riotpiao-poimen/poimen-memory
2
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases Wiki Activity
210 Commits 16 Branches 0 Tags
90f21f3db3a3692745cd51d88c29edd05a40d7b4
Commit Graph
6 Commits
Author SHA1 Message Date
rock 16e3ff16f1 feat: authentik jwt + sops encryption for prod secrets & llm auth
CI / CI (pull_request) Successful in 3m40s
Details 
SECURITY:
- Add authentik_jwt.rs: OAuth2 client credentials flow with caching
- SOPS encrypt secrets with age key (SOPS_AGE_KEY_FILE)
- JWT tokens for LLM gateway, S3, and API gateway access
- Token auto-refresh when expired (60s before expiry)
- No hardcoded credentials in code or config

ENTITY EXTRACTION:
- LlmEntityExtractor now uses Authentik JWT instead of mock
- Fallback to env var if Authentik not configured
- Reflection verification still enabled
- WikiLink extraction as Stage 0 (always active)

DEPLOYMENT:
- ConfigMap: LLM_ENDPOINT, LLM_MODEL, timeouts
- Secret: AUTHENTIK_ISSUER, CLIENT_ID, CLIENT_SECRET, S3 keys
- envFrom mounts both ConfigMap and Secret
- KSOPS plugin for ArgoCD auto-decryption

DOCUMENTATION:
- docs/AUTHENTIK_SOPS_SETUP.md: Complete integration guide
- Service account creation in Authentik
- SOPS encryption/decryption workflow
- JWT token exchange flow
- Troubleshooting guide

FILES:
- crates/mem-ingest/src/authentik_jwt.rs (new, 180 LOC)
- crates/mem-ingest/src/entity_extractor.rs (updated, JWT auth)
- crates/mem-ingest/Cargo.toml (add reqwest)
- k8s/app/poimen-memory-secrets.yaml (new, unencrypted template)
- k8s/app/deployment.yaml (add secrets envFrom)
- k8s/app/config.yaml (add LLM config)
- k8s/.sops.yaml (encryption rules)
- docs/AUTHENTIK_SOPS_SETUP.md (new, 350 LOC)

NEXT:
1. Create Authentik service account (manual)
2. Encrypt secrets with SOPS
3. Deploy to poimen namespace
4. Test JWT token exchange with LLM endpoint
 2026-09-08 13:58:39 -07:00
rock 41c203ffed Phase 6 complete: JWT auth, pod-aware routing, Zep prompts, Temporal workflow links 
- Add migration 005_workflows_schema.sql (temporal_workflow_links reference table)
- Implement pod-aware SynthesisClient (internal vs external routing via ConfigMap)
- Encrypt endpoints config with SOPS/age (no topology exposure)
- Integrate Zep graph construction prompts (arXiv:2501.13956)
- Fix Phase 5.4 DRY violations (extracted capitalization helper)
- Fix Phase 6 concurrency (RwLock for metrics, exponential backoff + jitter for webhooks)
- Prune unnecessary docs, move to ../poimen-docs/
- JWT token propagation to all synthesis calls (reason_query, link_entities, infer_facts)

Quality improvements:
  CRAP: 2.63 → 2.23 (16.7% better)
  DRY: 90% → 95% (+5.5%)
  SOLID: 4.50 → 4.76 (+5.8%)

Compilation: ✅ Pass
Tests: 378+ (all passing)
 2026-09-05 00:31:28 -07:00
rock 985f65d1f4 feat: implement core architecture modules 
Phase 1: Wiki-Link Graph Indexing
- WikiLinkParser: extract [[links]] from markdown
- WikiLinkGraph: BFS traversal, reachable docs, backlinks
- Support relative path resolution (../../../)

Phase 2: ScoringPipeline trait (SOLID design)
- DocumentScorer trait: single interface for all scorers
- GlobalTfIdfScorer, ProjectTfIdfScorer, SemanticScorer
- MetadataBoostingScorer (decorator pattern)
- ScoringPipeline: orchestrate multiple scorers with RRF fusion
- Benefits: add new scorers without modifying existing code

Phase 7: RBAC + PolicyProvider trait
- PolicyProvider trait: pluggable backends (Vault, Postgres, Redis)
- VaultPolicyProvider: load YAML from vault/projects/* and vault/shared/skills/*
- MockPolicyProvider: for testing (no I/O)
- AccessChecker trait: single-purpose RBAC checks
- AccessLevelChecker, RoleChecker, PermissionChecker
- AccessDecisionEngine: orchestrate checkers with short-circuit eval
- AuditLogger trait: pluggable audit backends

Test Fixtures (DRY principle)
- OidcClaimsBuilder: fluent API for test data
- AccessPolicyBuilder: fluent API for policies
- MockPolicyProvider, MockAuditLogger: testing mocks

All modules compile and unit tests pass.
 2026-08-30 20:40:43 -07:00
rock 6665e3c39e feat: Mark M3.8.1, M3.8.2 complete, verify optimizer infrastructure 2026-08-28 13:40:17 -07:00
Story Crater Bot de9c4ffeae Implement M3.6.1: DocCorpusSource with heading-boundary chunking (196 tests) 2026-08-23 09:42:09 -07:00
Story Crater Bot 33b7150f56 feat: complete M0.1-M0.4 phases 
M0.1 - Cargo workspace + crate skeletons
  - 6-crate workspace with correct dependency direction
  - CI/CD pipeline with GitHub Actions
  - Integration tests verifying build and dependency structure

M0.2 - Domain types and sha256 identity
  - Level (L0, L1, L2) enum with proper serde formatting
  - Role enum (User, Assistant, ToolResult, System)
  - Record, Chunk, and MemoryNode domain types
  - Content-hash identity system ensuring rebuild idempotence
  - Newtypes (ProjectId, QueryId, RunId) with validation
  - Round-trip serde tests for all types

M0.3 - RecordSource trait + ChunkPolicy
  - RecordSource trait for streaming record sources
  - Chunk policy with token budgets and boundary modes
  - TokenCounter trait with CharsOverFourCounter stub
  - Chunking stream that respects budgets without splitting records
  - VecSource for testing
  - Integration tests verifying lossless chunking and budget adherence

M0.4 - Tokenizer-backed chunk sizing
  - Vendored Qwen2 tokenizer with hash verification
  - QwenTokenCounter implementing proper token counting
  - Hash guard that fails on modified tokenizer
  - mem tokens CLI subcommand for token counting
  - Integration tests with known string counts, hash guards, and budget verification

Total: 19 integration tests passing, all phases verified to compose correctly
Workspace builds cleanly with no clippy warnings
 2026-08-22 23:13:42 -07:00