rock/poimen-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
175 Commits 8 Branches 0 Tags
main
Commit Graph
19 Commits
Author SHA1 Message Date
rock 41c203ffed Phase 6 complete: JWT auth, pod-aware routing, Zep prompts, Temporal workflow links 
- Add migration 005_workflows_schema.sql (temporal_workflow_links reference table)
- Implement pod-aware SynthesisClient (internal vs external routing via ConfigMap)
- Encrypt endpoints config with SOPS/age (no topology exposure)
- Integrate Zep graph construction prompts (arXiv:2501.13956)
- Fix Phase 5.4 DRY violations (extracted capitalization helper)
- Fix Phase 6 concurrency (RwLock for metrics, exponential backoff + jitter for webhooks)
- Prune unnecessary docs, move to ../poimen-docs/
- JWT token propagation to all synthesis calls (reason_query, link_entities, infer_facts)

Quality improvements:
  CRAP: 2.63 → 2.23 (16.7% better)
  DRY: 90% → 95% (+5.5%)
  SOLID: 4.50 → 4.76 (+5.8%)

Compilation: ✅ Pass
Tests: 378+ (all passing)
 2026-09-05 00:31:28 -07:00
rock 92458e643c fix: remove unused vault PVC from memory deployment 
Memory service stores in pgvector, not local files.
PVC was RWO causing multi-node scheduling failures with 2 replicas.
MEM_HOME points to /tmp (emptyDir) for any scratch needs.
 2026-08-30 07:23:18 -07:00
rock 2501a68528 fix: add PodSecurity contexts to all poimen deployments 
- runAsNonRoot, runAsUser 1000, seccompProfile RuntimeDefault
- Drop ALL capabilities, no privilege escalation
- readOnlyRootFilesystem on memory (with /tmp emptyDir)
- git-sync init runs as root with only CHOWN+DAC_OVERRIDE caps
- All pods use their service accounts
 2026-08-30 07:20:08 -07:00
rock d6b6c763b6 fix: remove obsidian-remote UI (too glitchy via noVNC) 2026-08-29 09:37:07 -07:00
rock 10d7a0be77 fix: chown vault to uid 1000 after git-sync (obsidian runs as 1000) 2026-08-28 20:44:38 -07:00
rock c1167563b1 fix: add safe.directory for git-sync init container 2026-08-28 20:43:40 -07:00
rock 82507cf2a3 fix: move obsidian vault PVC to homelab repo (infra-managed) 2026-08-28 20:42:18 -07:00
rock 23019fdb27 fix: obsidian vault PVC ReadWriteMany for shared access 2026-08-28 20:28:37 -07:00
rock 89b4995213 fix: add obsidian + obsidian-ui to kustomization.yaml 2026-08-28 17:22:12 -07:00
rock cfae6f300f feat: add obsidian-remote UI for browsable vault in browser 
sytone/obsidian-remote provides full Obsidian Desktop via noVNC.
Shares vault PVC with obsidian-server (REST API stays for memory system).
UI accessible at obsidian.riotpiao.com
 2026-08-28 17:20:35 -07:00
rock a60c74fc78 fix: move obsidian ingress to homelab repo, use obsidian.riotpiao.com 
vault.riotpiao.com was already taken by HashiCorp Vault.
Ingress now managed centrally in homelab/k8s/bootstrap/ingress/ingress.yaml
 2026-08-28 16:43:36 -07:00
rock 2ddd2d6cdf fix: remove broken auth annotations from obsidian ingress 
Bearer auth-url was misconfigured (pointed to token endpoint, not
forward-auth). No Authentik outpost deployed yet. Remove for now,
vault.riotpiao.com accessible directly. TODO: add forward-auth
once outpost is set up.
 2026-08-28 16:42:00 -07:00
rock b94898d0d4 feat: obsidian git-sync from poimen-obesdient-memory repo 
- Add git-sync init container to clone/pull vault content
- Add SOPS-encrypted SSH deploy key (obsidian-git-ssh-secret.enc.yaml)
- Add .sops.yaml config (age encryption, same key as homelab)
- Repo: ssh://[email protected]:2222/rock/poimen-obesdient-memory.git
- Deploy key added to Forgejo repo (read-only)
 2026-08-28 16:31:48 -07:00
Story Crater Bot 69ec8aeec2 fix: Obsidian service port and health checks, use Longhorn storage 2026-08-27 21:37:47 -07:00
Story Crater Bot 0eecca815b refactor: replace Obsidian projector with standalone service (ppatlabs/obsidian) 2026-08-27 21:35:07 -07:00
Story Crater Bot 56bee1915e chore: Archive completed task files (M0, M1, M3, M3.5, M4.1-2, M3.6.1) 
Deleted 31 completed task files:
- M0.x: 8 tasks (cargo, domain types, recordsource, tokenizer, adapters, gate)
- M1.x: 8 tasks (llm-chat, standing-query, prompt template, parser, loop, log, e2e, gate)
- M3.x: 4 tasks (l2-synthesis, rerank, mem-query, gate)
- M3.5.x: 8 tasks (http-server, ingest, query, federation, skills, projects, rate-limiting, gate)
- M3.6.1: DocCorpusSource (heading-boundary chunking)
- M4.1-2: skill-draft, derived-filter

Updated INDEX.md:
- Removed M0 & M1 phase sections (archived in git history)
- Updated progress table: 65 active tasks (42✅ + 2🟡 + 21⬜)
- Updated status: M0/M1 complete, M3/M3.5 gates passing, M4.1-2 done
- Noted M3.5.10 JWT auth implementation complete (awaiting image rollout)
- Cleaned up broken links to deleted task files

Total test count: 239 passing, 2 ignored (up from 196 at M3.4)
Ready for M4.3 gate composition, M5 post-training, M7 source connectors.
 2026-08-27 20:25:05 -07:00
rock 46d993824f feat: add Obsidian vault projection with Longhorn storage (#13) 2026-08-24 01:58:39 +00:00
Story Crater Bot de9c4ffeae Implement M3.6.1: DocCorpusSource with heading-boundary chunking (196 tests) 2026-08-23 09:42:09 -07:00
Story Crater Bot eaed7fc42a Add K8s app deployment, Dockerfile, and CI workflow (Option A) 2026-08-23 00:01:30 -07:00