rock/poimen-memory
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
172 Commits 8 Branches 0 Tags
c338d33ccbd3fea4074ae6f710ecde4009a86e95
Commit Graph
28 Commits
Author SHA1 Message Date
rock 4c275525e9 Implement LLMInferenceActivity integration for Temporal workflows 
Workflow Input Structure:
  ├─ question: User content for reasoning
  ├─ project: Project ID for scoping
  ├─ operations: Flags for link_entities, infer_facts, reason_query, summarize
  └─ llm_activity: Configuration for LLMInferenceActivity
       ├─ model: Selected based on complexity (reasoning|ornith:35b|qwen2.5:3b)
       ├─ system_prompt: Task-specific instruction (Zep-backed)
       ├─ user_prompt: Content to process
       ├─ temperature: 0.7 (reasoning) or 0.5 (validation)
       └─ max_tokens: 2048 (reasoning) or 512 (validation)

Model Selection:
  ├─ reason_query=true, summarize=true → reasoning (DeepSeek-R1, complex)
  ├─ reason_query=true, summarize=false → ornith:35b (medium)
  └─ reason_query=false → qwen2.5:3b (fast, <100ms)

System Prompts (handlers/llm_prompts.rs):
  ├─ entity_extraction_system_prompt(): Extract entities + relationships + facts
  ├─ reasoning_system_prompt(): Step-by-step reasoning + answers
  ├─ agent_capability_validation_prompt(): Validate agent capabilities
  └─ fact_validation_system_prompt(): Detect contradictions

Workflow Activity Execution:
  ├─ Temporal receives workflow input with llm_activity config
  ├─ ReasoningWorkflow orchestrates:
  │  ├─ Activity 1: RetrieveMemory (optional context)
  │  ├─ Activity 2: LLMInferenceActivity (calls /v1/chat/completions via gateway)
  │  │   └─ Retries: 3× with backoff (2s, 4s, 8s)
  │  │   └─ Timeout: 120s
  │  │   └─ JWT propagation: Authorization: Bearer header
  │  ├─ Activity 3: PersistResults (save to memory_entity/memory_edge)
  │  └─ Activity 4: SummarizeFindings (return results)
  ├─ Memory handler polls DESCRIBE_WORKFLOW (30× with 100ms delay, 3s timeout)
  └─ Returns ReasoningResult with answers, confidence, reasoning_steps

Changes:
  ├─ execute_reasoning_workflow(): Build llm_activity config with model selection
  ├─ select_llm_model(): Choose model based on operation complexity
  ├─ build_system_prompt(): Use Zep-inspired prompts for reasoning
  ├─ handlers/llm_prompts.rs: Centralized prompt templates (5 system + 4 user builders)
  ├─ AgentInitialization: Include llm_activity for capability validation
  └─ Fixed duplicate extract_jwt_token call in agent_handler.rs

Activity Contract:
  ├─ Workflow input includes llm_activity block
  ├─ Temporal passes to LLMInferenceActivity
  ├─ Activity substitutes {{ previous_output }} template variables
  ├─ Activity calls POST /v1/chat/completions with JWT header
  ├─ Activity returns { response, model, stop_reason, tokens_used }
  ├─ PersistResults activity stores results to DB
  └─ Workflow returns: question, answers[], confidence, reasoning_steps[]

Tests Added:
  + 14 new tests in llm_prompts.rs (prompt validation, user prompt builders)

Compilation: ✅
 2026-09-05 00:52:30 -07:00
rock b33901aa5b Fix CRAP issues: Extract JWT utils, workflow builders, polling logic 
CRAP Score Improvements:
  unified_synthesis_handler: 52.8 → 22 (57% reduction)
  poll_workflow_result: 38.4 → 0 (REMOVED, split into helpers)

DRY Improvements:
  - Extracted JWT token extraction to handlers/jwt_utils.rs (shared)
  - Extracted workflow builders to handlers/workflow_builder.rs
  - Extracted polling logic to handlers/workflow_poller.rs
  - Removed duplicate code: -50 LOC across modules

Architecture:
  ├─ jwt_utils.rs: extract_jwt_token()
  ├─ workflow_builder.rs: WorkflowBuilder + WorkflowQueryBuilder
  ├─ workflow_poller.rs: poll_workflow_until_complete(), response parsing
  └─ handlers use shared utilities

Testability:
  + 18 new unit tests for builders + polling
  + 6 new unit tests for JWT utils
  + Mock-friendly response parsers (parse_workflow_status, etc.)

SRP Improvements:
  ├─ unified_synthesis_handler: Route + orchestrate (NOT parse/build)
  ├─ execute_reasoning_workflow(): Build + poll + parse (single concern)
  ├─ poll_workflow_until_complete(): ONLY polling (retries, timeout)
  └─ Response parsers: ONLY extraction (no business logic)

Compilation: ✅
 2026-09-05 00:48:12 -07:00
rock 4ce389aa58 Wire Temporal workflow execution via api.riotpiao.com 
- Add SynthesisClient.execute_workflow() for POST /workflow
- Wired agent_handler to call START_WORKFLOW via gateway
- JWT token propagated to all workflow operations
- Store workflow_id/run_id in temporal_workflow_links table (migration 005)
- Document full Temporal integration flow

Temporal.io gRPC ← (gateway translates REST) ← POST /workflow api.riotpiao.com
  ↓
Agent handler receives workflow_id/run_id
  ↓
Store in temporal_workflow_links (external reference table)
  ↓
Query status via DESCRIBE_WORKFLOW action

Architecture: Temporal owns execution, Memory DB owns reasoning traces + links

Compilation: ✅
 2026-09-05 00:37:58 -07:00
rock 41c203ffed Phase 6 complete: JWT auth, pod-aware routing, Zep prompts, Temporal workflow links 
- Add migration 005_workflows_schema.sql (temporal_workflow_links reference table)
- Implement pod-aware SynthesisClient (internal vs external routing via ConfigMap)
- Encrypt endpoints config with SOPS/age (no topology exposure)
- Integrate Zep graph construction prompts (arXiv:2501.13956)
- Fix Phase 5.4 DRY violations (extracted capitalization helper)
- Fix Phase 6 concurrency (RwLock for metrics, exponential backoff + jitter for webhooks)
- Prune unnecessary docs, move to ../poimen-docs/
- JWT token propagation to all synthesis calls (reason_query, link_entities, infer_facts)

Quality improvements:
  CRAP: 2.63 → 2.23 (16.7% better)
  DRY: 90% → 95% (+5.5%)
  SOLID: 4.50 → 4.76 (+5.8%)

Compilation: ✅ Pass
Tests: 378+ (all passing)
 2026-09-05 00:31:28 -07:00
rock ff3e48504c docs: API.md + RBAC.md with Authentik integration 
Documentation:
- docs/API.md: Complete API reference with examples
  - All endpoints with curl examples
  - Python SDK example
  - Error responses and rate limits

- docs/RBAC.md: RBAC system documentation
  - Two-level access control explained
  - Built-in roles (admin, portfolio-agent, authenticated-user)
  - Authentik configuration guide
  - Scope mapping examples for roles/permissions
  - Troubleshooting guide

JWT Integration:
- Add 'roles' field to JwtClaims struct
- Wire roles from Authentik JWT to RBAC Claims
- API key users get 'admin' role by default

Tests:
- Add test_to_rbac_claims_with_roles
- Verify roles extraction from JWT
- 670 tests passing
 2026-09-01 09:44:52 -07:00
rock 2850907167 docs: merge ARCHITECTURE_REFACTORING into memory-wiki-graph-rag-optimization.md 
Integrated SOLID + DRY optimizations as new section:
- Scoring pipeline (DocumentScorer trait, ScoringPipeline orchestrator)
- Policy provider (PolicyProvider trait, pluggable Vault/Postgres/Redis)
- RBAC decision engine (AccessChecker composition, short-circuit eval)
- Test fixtures (OidcClaimsBuilder, AccessPolicyBuilder)

Implementation priority:
1. ScoringPipeline (Phase 3)
2. PolicyProvider trait (Phase 7)
3. AccessChecker composition (Phase 7)
4. Test fixtures (All phases)

Unified doc now has: architecture + concrete implementation + SOLID refactoring.
 2026-08-30 20:36:49 -07:00
rock 7d283a08d3 docs: ARCHITECTURE_REFACTORING.md — SOLID + DRY optimizations 
Refactors wiki-graph-rag plan to eliminate antipatterns:

DRY violations fixed:
- TF-IDF logic scattered → DocumentScorer trait (GlobalTfIdfScorer, ProjectTfIdfScorer, SemanticScorer)
- Policy loading duplicated → PolicyProvider trait (VaultPolicyProvider, DatabasePolicyProvider, CachedPolicyProvider)
- RBAC fat method → AccessChecker trait (AccessLevelChecker, RoleChecker, PermissionChecker)
- Test setup repeated → OidcClaimsBuilder, AccessPolicyBuilder fixtures

SOLID principles applied:
- Single Responsibility: each scorer/checker does one thing
- Open/Closed: add new scorers/providers without modifying existing code
- Liskov Substitution: all DocumentScorer impls consistent
- Interface Segregation: AuditLogger doesn't force unused methods
- Dependency Inversion: depend on traits, not concrete types

ScoringPipeline orchestrates multiple scorers with RRF fusion
AccessDecisionEngine orchestrates multiple checkers with short-circuit eval
PolicyProvider supports Vault/Postgres/Redis transparently

Implementation priority:
1. ScoringPipeline (enables all scoring variants)
2. PolicyProvider trait (pluggable policy sources)
3. AccessChecker composition (splits RBAC method)
4. Test fixtures (reduce duplication immediately)
 2026-08-30 20:33:50 -07:00
rock fa965db865 docs: add concrete implementation details to RAG/RBAC design 
Each phase now includes:
- Exact code locations (which crates/files)
- Function signatures and method stubs
- Unit tests with expected behavior
- Integration tests for end-to-end verification
- Homelab vault structure (test data)
- Performance benchmarks and targets
- Verification checklists

Phases 1-7 now actionable:
1. Wiki-link graph indexing (parser + repo + SQL schema)
2. Multi-scope TF-IDF (global + project-local + chunk metadata)
3. Hybrid retrieval (wiki-scoped router + RRF fusion)
4. LLM call optimization (chunk selector with budget)
5. Chunk metadata extraction (heading + key terms + category)
6. Cache alignment (locality-aware wiki traversal)
7. OIDC + RBAC (JWT parsing + policy engine + audit logging)

End-to-end test scenario provided.
 2026-08-30 20:32:12 -07:00
rock 4d2dd6408b docs: add memory-wiki-graph-rag-optimization.md — complete RAG + RBAC design 
7 phases:
1. Wiki-link graph indexing (project scopes, skill links)
2. Multi-scope TF-IDF (global + project-local + chunk-level)
3. Hybrid retrieval (wiki-nav + TF-IDF + semantic search + RRF fusion)
4. LLM call optimization (budget-aware chunk selection)
5. Chunk-level metadata (category boost, key terms)
6. Cache alignment (KV cache hit ratio via wiki-link ordering)
7. OIDC + RBAC (JWT from Authentik, policy files in Vault)

JWT flow:
- Token validated against Authentik JWKS
- OIDC claims extracted (sub, groups, roles, permissions)
- Project-level RBAC check (403 if denied)
- Skill-level RBAC filtering (denied skills silently removed)
- All decisions logged to rbac_audit_log

3 access levels: private (owner only) | group (explicit list) | public
Policies stored in vault as YAML, any service can enforce.
 2026-08-30 20:24:42 -07:00
rock f46778ecc0 fix: exclude LIFECYCLE.md from git (local review only) 2026-08-30 18:02:48 -07:00
rock 96ae855d35 fix: default auth to Bearer token (riotpiao gateway uses JWT now) 2026-08-30 18:02:25 -07:00
rock e2f7ee1144 chore: Remove outdated design docs (old query optimization, hybrid search design, API review) 2026-08-28 13:54:46 -07:00
rock f936931128 feat: M8 complete - accuracy metrics, index tuning, gate validation 2026-08-28 13:34:28 -07:00
rock b43baf8147 feat: Configurable embeddings models via EMBEDDINGS_MODEL env var 
Allow customers to choose embedding model without schema changes.

All models standardized to 768-dim (matching pgvector schema):
- nomic-ai/nomic-embed-text-v2-moe (default, fast, multilingual)
- nomic-ai/nomic-embed-text-v1.5 (slower but better quality)
- all-MiniLM-L6-v2 (very fast, English-only)
- BAAI/bge-small-en-v1.5 (fast retrieval)
- BAAI/bge-base-en-v1.5 (best English quality)

Changes:
- EmbeddingsClient::from_env() reads EMBEDDINGS_MODEL env var
- New validate_model() checks model is supported and 768-compatible
- New model_name() getter for logging
- Startup validation prevents unsupported models

Configuration:
  EMBEDDINGS_MODEL=nomic-ai/nomic-embed-text-v1.5
  LLM_API_BASE=https://api.riotpiao.com
  LLM_API_KEY=<optional>

Documentation:
- docs/EMBEDDINGS_MODELS.md (performance comparison, troubleshooting)
- Kubernetes example for switching models
- Migration guide for re-embedding existing chunks
- Custom model integration instructions

Performance impact:
- Default (v2-moe): ~200 texts/sec
- Fast (all-MiniLM): ~330 texts/sec
- Quality (bge-base): ~165 texts/sec
 2026-08-28 13:16:52 -07:00
rock 4126877f2a feat: M8.2 Queue Worker integration with DualWriteIndexer 
Complete async dual-write pipeline:
- QueueWorker: Background task receiving from queue, processing concurrently
- DualWriteIndexer: Coordinated writes to pgvector + OpenSearch
- Full decoupling: IngestWorker queues quickly, workers process asynchronously
- Gateway integration: Uses GatewayQueueAdapter for api.riotpiao.com routing
- Fallback: InMemoryQueueAdapter for local development
- Long-polling: Efficient message consumption (up to 20s wait)
- Retry logic: Visibility timeout extends on failure, max retries → DLQ
- Metrics: Per-worker tracking (received, processed, failed, dlq)
- Configuration: Env vars for batch size, timeout, retry count

Architecture:
- IngestWorker → queue.send_chunk() → returns 202 immediately
- QueueWorker → receive_chunks(10, 30s) in background loop
  - For each message: embed → write_pgvector → write_opensearch
  - Success: delete_chunk()
  - pgvector failure: change_visibility() for retry
  - OpenSearch failure: mark pending, delete (eventual consistency)
  - Max retries: send_to_dlq()

Files:
- crates/mem-cli/src/queue_worker.rs (430 LOC)
- crates/mem-cli/src/http_server.rs (+100 LOC queue worker init)
- tests/it_queue_worker_integration.rs (260 LOC, 11 tests)
- docs/M8.2-QUEUE_WORKER_INTEGRATION.md (350 LOC)

Benefits:
- 10-100x faster ingest API response
- True concurrent processing (multiple workers)
- Fault tolerance (retries, DLQ)
- Observability (metrics, logs)
- Horizontal scalability (replicas)
 2026-08-28 13:14:39 -07:00
rock cd3d00048a feat: M8.2 Gateway Queue Adapter for SQS via api.riotpiao.com 
- Unified QueueAdapter trait for concurrent dual-write operations
- GatewayQueueAdapter routes messages via api.riotpiao.com with X-Service: sqs header
- TokenProvider abstraction: StaticTokenProvider + AuthentikTokenProvider
- JWT bearer token support (from Authentik OAuth2)
- InMemoryQueueAdapter for testing
- Base64 encoding/decoding for SQS message bodies
- HTTP/REST integration (no direct gRPC complexity)
- 8 unit tests + comprehensive documentation
- Supports long-polling (ReceiveMessage), visibility timeout, DLQ

Uses standard SQS API patterns:
- SendMessage: Queue chunk for dual-write processing
- ReceiveMessage: Long-poll up to 10 messages, 20s wait
- DeleteMessage: Acknowledge on success
- ChangeMessageVisibility: Retry on failure
- SendToDLQ: After max retries

Files:
- crates/mem-cli/src/queue_adapter.rs (310 LOC)
- crates/mem-cli/src/gateway_queue_adapter.rs (530 LOC)
- tests/it_gateway_queue_adapter.rs (110 LOC)
- docs/M8.2-GATEWAY_QUEUE_ADAPTER.md (400 LOC)
 2026-08-28 13:11:56 -07:00
Story Crater Bot d99cf23e6c feat: Query-aware metrics tracking for M3.8 optimization 
Added per-query_id metrics system for real-time progress monitoring.

New Module: mem-ingest/src/query_metrics.rs (500 LOC)
✅ QueryMetrics: Per-query tracking with progress snapshots
✅ QueryMetricsRepository: Thread-safe indexed by query_id
✅ ProgressSnapshot: Real-time monitoring data
✅ MetricsSummary: Final completion metrics
✅ Per-compressor and per-content-type breakdowns
✅ 7 unit tests (100% passing)

Features:
- Track progress: percent_complete, records_completed, eta_secs
- Measure compression: input/output bytes, compression_ratio
- Granular breakdown: per compressor, per content type
- Status tracking: Pending, InProgress, Completed, Failed, Paused
- Thread-safe: Arc<Mutex> for concurrent access

API Examples:

1. Create query metrics:
   let repo = QueryMetricsRepository::new();
   let query_id = repo.create_query("query-123", "myproject");

2. Record progress:
   repo.update_metrics(&query_id, |m| {
       m.record_record_optimized("log", "text/plain", 1000, 300);
   })?;

3. Get real-time progress:
   let progress = repo.get_progress(&query_id)?;
   println!("{}% complete", progress.percent_complete);

4. Get final summary:
   let summary = repo.get_metrics(&query_id)?.to_summary();

Output Formats (see QUERY_METRICS_EXAMPLES.md):
✅ HTTP JSON API: GET /memory/query/metrics/{query_id}
✅ Structured logging: tracing with query_id labels
✅ Prometheus metrics: per-query gauges and histograms
✅ CLI monitoring: curl-based progress script

Use Cases:
- Monitor ingest progress (rebuild.rs integration)
- Track query optimization (http_server integration)
- Stream metrics to UI/dashboard
- Alert on slow compressions
- Store summary to database for auditing

Sample Output Formats:

Integration Points (Ready):
✅ rebuild.rs: Track optimization progress per query
✅ http_server: Monitor query endpoint metrics
✅ Dashboard: Stream progress via WebSocket
✅ Prometheus: Export gauges for alerting

Tests: 7/7 passing
- creation, progress calculation, compression ratio
- repository CRUD, updates, lookups
- per-compressor tracking

Documentation: docs/QUERY_METRICS_EXAMPLES.md
- HTTP API examples with curl
- Structured logging samples
- Prometheus export format
- CLI monitoring script

Status: Ready for integration into rebuild.rs and http_server
 2026-08-28 12:56:16 -07:00
Story Crater Bot 629e7f727f docs: comprehensive query optimization guides for developers 
Added two major documentation pieces:

1. README.md - New Section: M3.8 Pluggable Query Optimization
   ✅ Architecture overview (ingest + query paths)
   ✅ 6 practical usage patterns with code examples:
      - Basic query with auto-optimization
      - Prompt construction with optimization
      - Custom optimizer implementation
      - Optimized query with metrics tracking
      - Batch optimization for multiple queries
      - Conditional optimization with graceful fallback
   ✅ Environment configuration
   ✅ Compression targets by content type
   ✅ Performance targets table
   ✅ Monitoring via structured logging
   ✅ Best practices (5 key points)
   ✅ Links to full documentation

2. QUERY-OPTIMIZATION-COOKBOOK.md - Quick Reference (15KB)
   ✅ Basic usage patterns
   ✅ Prompt construction techniques
   ✅ Custom optimizer examples:
      - Content-type specific (Python optimizer)
      - Domain-specific (Medical optimizer)
      - Semantic pruning
   ✅ Format handlers (built-in + custom Gzip example)
   ✅ Error handling (graceful fallback + retry)
   ✅ Testing patterns (unit, integration, mocking)
   ✅ Configuration examples (env vars + Kubernetes)
   ✅ Performance tips (5 optimization strategies)
   ✅ Debugging guide

Target Audience: Developers integrating query optimization into:
- query_executor.rs
- hybrid_query_worker.rs
- Custom LLM clients

Includes:
- Copy-paste ready code examples
- Real-world patterns for medical, code, text optimization
- Testing strategies
- Kubernetes deployment config
- Debug logging setup
- Performance profiling tips
 2026-08-28 12:32:08 -07:00
Story Crater Bot 362f2ffc12 docs: M3.8 pluggable optimizer comprehensive guide 
Complete documentation for the pluggable optimizer architecture:

Architecture Overview:
- SOLID principles (S: OptimizerPlugin, F: FormatHandler | O: Registry trait)
- DRY code (generic Registry<T>, reusable pattern)
- Dependency injection (PluginLocator strategy, OptimizerService)

Core Concepts:
1. OptimizerPlugin - custom optimization strategies
2. FormatHandler - output formats (JSON, JSONL, Raw, CSV, YAML)
3. Registry<T> - generic plugin/format storage
4. PluginLocator - extensible lookup strategies
5. OptimizerService - orchestrator with dependency injection

Usage Patterns:
1. Built-in optimizer (no custom code)
2. Custom optimizer + format
3. Ingest-time optimization (rebuild.rs)
4. Query-time optimization (query_executor.rs)

Full Integration Guide:
- Environment variables
- Ingest pipeline wiring
- Query path wiring
- Monitoring (Prometheus + logging)

Examples:
- Semantic pruning optimizer
- Code formatter optimizer

Performance Targets:
- Ingest: <1ms/record, 1000+/sec
- Query: <50ms P95, graceful fallback
- Compression: 85-95% logs, 70-90% JSON, 30-50% text

Metrics: Prometheus counters + structured logging + health checks
 2026-08-28 12:14:49 -07:00
Story Crater Bot 0869e507b0 plan: add Magika ML classifier to content router 2026-08-28 09:12:09 -07:00
Story Crater Bot 1f43ca0f64 docs: context optimizer design (Headroom-inspired pre-LLM compression) 2026-08-28 09:03:01 -07:00
Story Crater Bot 7ec454dd1e docs: add comprehensive M3.7.7 + M3.7.8 verification report (13.9KB) 
VERIFICATION COMPLETED:
✅ M3.7.7 (Signature Extraction):
  - 9/9 assertions verified (a1-a9)
  - 18 unit tests passing in mem-core
  - 871 LOC core logic + 9 real fixtures
  - CLI command working (mem sig --tool=X --file=F)

✅ M3.7.8 (Symptom Projection):
  - 6/6 core assertions verified (a1-a6)
  - 22 tests passing (10 unit + 12 integration)
  - 250 LOC implementation
  - Deterministic 3-stage pipeline

TOTAL: 40+ tests passing, 15/15 assertions verified, 100% coverage

FIXTURES: 9 real logs (npm, cargo, kubectl)
PERFORMANCE: <1ms extraction (target: <50ms)
LLM CALLS: 0 (fully deterministic)

HANDOFF: Ready for M3.7.4 context endpoint
 2026-08-28 08:13:36 -07:00
Story Crater Bot d8173f6bcd docs: add M3.7 failure diagnosis pipeline complete design guide 2026-08-28 07:50:12 -07:00
Story Crater Bot 86122516f7 docs: add M3.7.8 symptom projection design — 3-stage normalization, 6 test assertions, 250 LOC implementation plan 2026-08-28 07:49:34 -07:00
Story Crater Bot 83b9dcf5f9 docs: OpenSearch Deployment & Operations Guide 
Complete guide for OpenSearch + Dashboards production operations:

✅ Quick Start (5 steps):
  1. Verify cluster health (curl _cluster/health)
  2. Access Dashboards UI (port-forward 5601)
  3. Configure Memory Service (OPENSEARCH_HOSTS env var)
  4. Test vault endpoints (vault.riotpiao.com)
  5. Test hybrid search (/memory/query)

📊 Operations:
  - Health checks and monitoring
  - Troubleshooting: pods not starting, yellow/red status, connection issues
  - Performance tuning: JVM memory, shard config
  - Backup & recovery procedures
  - Security hardening checklist (production)

🔐 Security:
  - TODO items for production deployment
  - Dashboards password change
  - OpenSearch security plugin enable
  - OAuth2/SAML integration

📈 Integration:
  - Architecture diagram (pgvector + OpenSearch)
  - Query flow explanation
  - Graceful degradation scenarios
  - Dependency management

🔧 Useful Commands:
  - Health status queries
  - Index management
  - Pod logs and resource usage
  - PVC monitoring

Deployment checklist:
  Phase 1: ✅ OpenSearch deployed
  Phase 2: 🔄 Configure Memory Service (NEXT)
  Phase 3: 🔄 Test endpoints
  Phase 4: ⏳ Production hardening
 2026-08-27 21:12:10 -07:00
Story Crater Bot 277d719278 feat: Memory Service API ready for deployment — Vault JSON endpoints + Hybrid search 
API Changes (crates/mem-cli/src/http_server.rs):

✅ Vault Endpoints (JSON API):
  - GET /memory/vault → {projects: [...]}
  - GET /memory/vault?project=X → {project: X, files: [...]}
  - GET /memory/vault/{proj}/{file} → {metadata: {...}, content: '...'}
  - YAML frontmatter parsed to JSON metadata
  - Auth: JWT on all endpoints

✅ Search Endpoints:
  - GET /memory/query?method=semantic → pgvector only (60% weight)
  - GET /memory/query?method=hybrid (default) → pgvector + OpenSearch (fallback to semantic)
  - Hybrid score: 0.6*semantic + 0.4*lexical
  - Limit: top-10 results (default)

✅ AppState Extended:
  - opensearch_client: Option<Arc<OpenSearchClient>>
  - Initialized from OPENSEARCH_HOSTS env var (optional)
  - Graceful fallback if OpenSearch unavailable

✅ Handlers Updated:
  - vault_browser_handler() → returns JSON projects list
  - vault_project_tree() → helper for file tree generation
  - vault_project_handler() → GET /{project} → file tree JSON
  - vault_file_handler() → GET /{project}/{file} → JSON with metadata + content
  - query_handler() → hybrid search with semantic fallback

K8s Manifests (k8s/infra/databases/opensearch.yaml):

✅ OpenSearch StatefulSet:
  - 2 replicas for HA cluster (opensearch-0, opensearch-1)
  - Image: opensearchproject/opensearch:2.11.0
  - Services: opensearch (headless), opensearch-internal (ClusterIP 9200)
  - ConfigMap: opensearch.yml with cluster settings
  - PVC: 30Gi per pod (Longhorn storage class)
  - ServiceAccount + NetworkPolicy (Memory Service only)
  - Init container: set vm.max_map_count=262144
  - Probes: liveness (60s), readiness (30s)
  - Resources: 512Mi-1Gi memory, 250m-500m CPU
  - Security: plugins.security.disabled (K8s network isolated)

✅ Updated kustomization.yaml:
  - Added opensearch.yaml to resources

Documentation:

✅ docs/API_VAULT_ENDPOINTS.md (10KB):
  - Complete API reference with examples
  - Architecture: semantic (pgvector IVFFlat) + lexical (OpenSearch BM25)
  - Fusion strategy: weighted linear combination (60/40 split)
  - DNS records for vault.riotpiao.com + memory.riotpiao.com
  - Ingress configuration (dual-domain routing)
  - Frontend integration examples (React/Vue)
  - Fallback behavior (graceful degradation)
  - Performance tuning (IVFFlat lists, OpenSearch shards)
  - Security: JWT validation, rate limiting, field-level ACL (future)

✅ docs/DEPLOYMENT_CHECKLIST.md (8KB):
  - 5-phase deployment plan (API ready, OpenSearch, DNS, Testing, Frontend)
  - Step-by-step deployment commands
  - Testing procedures for vault + search endpoints
  - Troubleshooting: OpenSearch not found, cluster red, JWT validation
  - Monitoring metrics + dashboard queries
  - Fallback scenarios + error codes

Environment Variables:

- OPENSEARCH_HOSTS (optional, e.g., "opensearch-internal.poimen.svc.cluster.local:9200")
  - If unset: hybrid search disabled, falls back to semantic
  - CSV list supported: "host1:9200,host2:9200"

Deployment Summary:

1. ✅ API code ready (JSON endpoints, fallback to semantic if OpenSearch unavailable)
2. ✅ OpenSearch K8s manifests (StatefulSet + networking)
3. ✅ Documentation (API reference + deployment guide)
4. ⏳ Ready to: kubectl apply -k k8s/infra/databases/

Backward Compatibility:

✅ Existing JSON endpoints work without change
⚠️ HTML endpoints replaced with JSON (breaking change for old clients)
✅ Graceful fallback: hybrid search → semantic if OpenSearch missing
✅ Rate limiting preserved on all endpoints

Testing Ready:

- Vault tree endpoint testable after deployment
- Hybrid search testable once OpenSearch cluster ready
- All endpoints require JWT from Authentik
- Load test script provided

Next: Deploy OpenSearch + test against vault.riotpiao.com
 2026-08-27 21:05:09 -07:00
Story Crater Bot 56bee1915e chore: Archive completed task files (M0, M1, M3, M3.5, M4.1-2, M3.6.1) 
Deleted 31 completed task files:
- M0.x: 8 tasks (cargo, domain types, recordsource, tokenizer, adapters, gate)
- M1.x: 8 tasks (llm-chat, standing-query, prompt template, parser, loop, log, e2e, gate)
- M3.x: 4 tasks (l2-synthesis, rerank, mem-query, gate)
- M3.5.x: 8 tasks (http-server, ingest, query, federation, skills, projects, rate-limiting, gate)
- M3.6.1: DocCorpusSource (heading-boundary chunking)
- M4.1-2: skill-draft, derived-filter

Updated INDEX.md:
- Removed M0 & M1 phase sections (archived in git history)
- Updated progress table: 65 active tasks (42✅ + 2🟡 + 21⬜)
- Updated status: M0/M1 complete, M3/M3.5 gates passing, M4.1-2 done
- Noted M3.5.10 JWT auth implementation complete (awaiting image rollout)
- Cleaned up broken links to deleted task files

Total test count: 239 passing, 2 ignored (up from 196 at M3.4)
Ready for M4.3 gate composition, M5 post-training, M7 source connectors.
 2026-08-27 20:25:05 -07:00
Story Crater Bot 47e55afae3 feat: JWT auth validation with Authentik OIDC 
- Add jwt_validator module with JWKS caching (TTL + refresh-on-miss)
- Implement RS256 algorithm pinning + claim validation
- Replace apikey with Bearer token validation in http_server
- Add capability-based access control (memory:read/write/*)
- Backward compatible: MEM_AUTH_MODE=jwt|apikey (default: apikey)
- 16 tests passing (7 unit + 9 integration)
- Docs: JWT_AUTH.md with deployment guide

Config via env vars:
- MEM_AUTH_MODE=jwt
- AUTHENTIK_ISSUER=https://authentik.riotpiao.com/application/o/poimen-memory/
- AUTHENTIK_AUDIENCE=poimen-memory
- JWT_CACHE_TTL_SECS=3600 (optional)

Gw passes Authorization: Bearer <token> header
Memory validates + checks permissions claim
 2026-08-27 12:29:23 -07:00