rock
16e3ff16f1
CI / CI (pull_request) Successful in 3m40s
SECURITY: - Add authentik_jwt.rs: OAuth2 client credentials flow with caching - SOPS encrypt secrets with age key (SOPS_AGE_KEY_FILE) - JWT tokens for LLM gateway, S3, and API gateway access - Token auto-refresh when expired (60s before expiry) - No hardcoded credentials in code or config ENTITY EXTRACTION: - LlmEntityExtractor now uses Authentik JWT instead of mock - Fallback to env var if Authentik not configured - Reflection verification still enabled - WikiLink extraction as Stage 0 (always active) DEPLOYMENT: - ConfigMap: LLM_ENDPOINT, LLM_MODEL, timeouts - Secret: AUTHENTIK_ISSUER, CLIENT_ID, CLIENT_SECRET, S3 keys - envFrom mounts both ConfigMap and Secret - KSOPS plugin for ArgoCD auto-decryption DOCUMENTATION: - docs/AUTHENTIK_SOPS_SETUP.md: Complete integration guide - Service account creation in Authentik - SOPS encryption/decryption workflow - JWT token exchange flow - Troubleshooting guide FILES: - crates/mem-ingest/src/authentik_jwt.rs (new, 180 LOC) - crates/mem-ingest/src/entity_extractor.rs (updated, JWT auth) - crates/mem-ingest/Cargo.toml (add reqwest) - k8s/app/poimen-memory-secrets.yaml (new, unencrypted template) - k8s/app/deployment.yaml (add secrets envFrom) - k8s/app/config.yaml (add LLM config) - k8s/.sops.yaml (encryption rules) - docs/AUTHENTIK_SOPS_SETUP.md (new, 350 LOC) NEXT: 1. Create Authentik service account (manual) 2. Encrypt secrets with SOPS 3. Deploy to poimen namespace 4. Test JWT token exchange with LLM endpoint
Memory System Documentation
Phase 7 Complete ✅ | 84/84 tasks done
API Documentation
Phase 7 APIs
-
T7_VERSIONING_API.md — Version history, diffs, point-in-time queries
- GET /memory/entities/{id}/versions
- GET /memory/entities/{id}/diff?from=v1&to=v2
- GET /memory/entities/{id}/at?as_of=timestamp
-
T7_RANKING_API.md — Multi-signal ranking (7 signals, 3 profiles)
- GET /memory/ranking/profiles
- POST /memory/query with ranking_profile
-
T7_REBUILD_API.md — Deterministic rebuild with checksums
- POST /memory/rebuild
- GET /memory/rebuild/status
Operations & SLOs
RUNBOOK_PHASE7.md
- Incident response procedures
- Daily health check script
- Escalation paths
SLO Definitions
- availability.yaml — 99.9% uptime target
- latency.yaml — p99 <500ms latency targets
- consistency.yaml — 100% rebuild parity + audit integrity
Implementation Details
- PHASE_7_TEMPORAL_RAGA_INGEST_DESIGN.md — Temporal ingest patterns
- TEMPORAL_WORKFLOW_INTEGRATION.md — Workflow integration
- LLM_INFERENCE_ACTIVITY_INTEGRATION.md — LLM integration patterns
Quick Links
- Task Board: poimen-docs/tasks/INDEX.md
- Phase 7 Tasks: poimen-docs/tasks/T7.1-T7.6.md
- API Overview: poimen-docs/API_MEMORY_SYSTEM.md
- Scaling Strategy: poimen-docs/EXPERT_SCALE_ARCHITECTURE_REALISTIC.md
File Structure
docs/
├── README.md (this file)
├── api/
│ ├── T7_VERSIONING_API.md
│ ├── T7_RANKING_API.md
│ └── T7_REBUILD_API.md
├── operations/
│ └── RUNBOOK_PHASE7.md
├── slo/
│ ├── availability.yaml
│ ├── latency.yaml
│ └── consistency.yaml
└── Implementation details
├── PHASE_7_TEMPORAL_RAGA_INGEST_DESIGN.md
├── TEMPORAL_WORKFLOW_INTEGRATION.md
└── LLM_INFERENCE_ACTIVITY_INTEGRATION.md
Note: Task board is in poimen-docs/tasks/
Status: All Phase 7 documentation complete and deployment-ready