rock
dae9483a6a
feat(rbac): complete HTTP endpoint integration + role configs
...
HTTP Endpoints with RBAC:
- ingest_handler: project-level write access check
- learn_handler: project-level write access check
- projects_handler: filter returned projects by user access
- query_handler: filter search results by resource access
- context_handler: project-level read access check
Example Role Configurations (config/roles/):
- admin.yaml: full access to all resources
- portfolio-agent.yaml: public visitor access
- authenticated-user.yaml: logged-in user access
- homelab-team.yaml: team-scoped project access
All 660+ tests passing.
2026-09-01 08:43:49 -07:00
rock
41cdff3676
feat(rbac): wire AccessGuard into HTTP server and retrieval pipeline
...
HTTP Layer Integration:
- Add access_guard to AppState with builtin_role_provider
- Add to_rbac_claims() to convert JwtClaims → RBAC Claims
- Add query_result_to_resource_meta() for result filtering
Query Handler (/memory/query):
- RBAC filter applied after M3.8 optimization
- Batch check_access for all results
- Log filtered count per request
Context Handler (/memory/context):
- Project-level access check before lookup
- Return 403 if user lacks project access
Code Cleanup:
- Move http_server from bin to lib module
- Use mem_cli::http_server in main.rs
All 660+ tests passing.
2026-09-01 08:41:21 -07:00
rock
2448e5ebe2
feat(rbac): hierarchical access control with fine-grained scopes
...
Implements comprehensive RBAC system:
Core Types (types.rs):
- Role: named set of AccessRules
- AccessRule: (resources, verbs, scope) tuple
- AccessScope: project/visibility/owner/group constraints
- ResourceMeta: document metadata for access checks
- Verb: read/write/delete/query
- Visibility: public/private per document
Role Provider (role_provider.rs):
- RoleProvider trait for pluggable backends
- YamlRoleProvider: load from YAML files
- InMemoryRoleProvider: for testing
- CompositeRoleProvider: layered lookup
- Built-in roles: admin, portfolio-agent, authenticated-user
Scope Checker (scope_checker.rs):
- ScopeChecker trait + composite pattern
- ProjectScopeChecker: allowed projects list
- VisibilityScopeChecker: public/private matching
- OwnerScopeChecker: self/any/specific user
- GroupScopeChecker: required group membership
Access Guard (access_guard.rs):
- Unified API for HTTP + retrieval layers
- check_http_capability(): memory:read/write checks
- filter_resources(): document-level filtering
- Audit logging for all decisions
Tests: 77 unit + 25 integration, all passing
Migration note: AuthorizedPipeline retained for compatibility,
will be replaced by AccessGuard integration in next phase.
2026-08-31 23:22:11 -07:00
rock
21600c7231
feat(phase5-6): Wire metadata boost + cache alignment into FullPipeline
...
FullPipeline (Phase 1-6 Integration)
- FullPipeline: complete orchestration of all phases
- PipelineConfig: unified configuration for all phases
- PipelineBuilder: fluent API for pipeline construction
- EnrichedChunk: fully enriched result with all metadata
- PipelineMetrics: comprehensive metrics per phase
- 14 unit tests
Phase 5 Integration
- Query intent inference (FixError, LearnConcept, UseTool, FindReference)
- Category-based metadata boost
- Intent-category matching for relevance boost
Phase 6 Integration
- Wiki-distance based cache priority
- LRU cache preloading for hot chunks
- Cache slot assignment
- Phase timing profiling
Integration Tests (it_phase5_phase6.rs)
- 24 end-to-end tests covering all phases
- Metadata boost enable/disable
- Cache locality and preload
- Edge cases (empty, no matches, unknown intent)
Total: 145 tests passing (was 107)
2026-08-31 22:48:42 -07:00
rock
cd76424baa
feat(phase3-4): Complete hybrid retrieval + LLM optimization pipeline
...
Phase 3: Hybrid Retrieval
- HybridRetriever: TF-IDF prefilter + semantic rerank + RRF fusion
- WikiScopedFilter: BFS wiki-graph traversal
- RetrievalRoute: Direct | WikiScoped | ReferenceOnly
- 10 unit tests
Phase 4: LLM Call Optimization
- ChunkOptimizer: unified pipeline (threshold + budget + dedup)
- ScoreThresholdFilter: configurable min_score (default 0.6)
- BudgetSelector: greedy selection within byte budget
- ShingleDeduplicator: Jaccard similarity dedup
- 8 unit tests
QueryRouter (Phase 3+4 Integration)
- Bridges WikiLinkGraph + HybridRetriever + ChunkOptimizer
- RouterConfig: max_hops, thresholds, budget, RRF weights
- WikiGraphBuilder: construct graph from markdown docs
- 11 unit tests
Integration Tests (it_phase3_phase4.rs)
- 19 end-to-end tests covering full pipeline
- Wiki-link parsing, graph traversal, route selection
- TF-IDF prefilter, RRF fusion, chunk optimization
- Edge cases (empty, no matches, config customization)
Total: 107 tests passing (was 32)
2026-08-31 22:42:34 -07:00
rock
03c113214b
docs: add IMPLEMENTATION_STATUS.md — track progress on phases 1-7
2026-08-30 20:43:26 -07:00
rock