7 phases: 1. Wiki-link graph indexing (project scopes, skill links) 2. Multi-scope TF-IDF (global + project-local + chunk-level) 3. Hybrid retrieval (wiki-nav + TF-IDF + semantic search + RRF fusion) 4. LLM call optimization (budget-aware chunk selection) 5. Chunk-level metadata (category boost, key terms) 6. Cache alignment (KV cache hit ratio via wiki-link ordering) 7. OIDC + RBAC (JWT from Authentik, policy files in Vault) JWT flow: - Token validated against Authentik JWKS - OIDC claims extracted (sub, groups, roles, permissions) - Project-level RBAC check (403 if denied) - Skill-level RBAC filtering (denied skills silently removed) - All decisions logged to rbac_audit_log 3 access levels: private (owner only) | group (explicit list) | public Policies stored in vault as YAML, any service can enforce.
