Story Crater Bot 47e55afae3 feat: JWT auth validation with Authentik OIDC ...

- Add jwt_validator module with JWKS caching (TTL + refresh-on-miss)
- Implement RS256 algorithm pinning + claim validation
- Replace apikey with Bearer token validation in http_server
- Add capability-based access control (memory:read/write/*)
- Backward compatible: MEM_AUTH_MODE=jwt|apikey (default: apikey)
- 16 tests passing (7 unit + 9 integration)
- Docs: JWT_AUTH.md with deployment guide

Config via env vars:
- MEM_AUTH_MODE=jwt
- AUTHENTIK_ISSUER=https://authentik.riotpiao.com/application/o/poimen-memory/
- AUTHENTIK_AUDIENCE=poimen-memory
- JWT_CACHE_TTL_SECS=3600 (optional)

Gw passes Authorization: Bearer <token> header
Memory validates + checks permissions claim

2026-08-27 12:29:23 -07:00

..

mem-chunk

Implement M3.6.1: DocCorpusSource with heading-boundary chunking (196 tests)

2026-08-23 09:42:09 -07:00

mem-cli

feat: JWT auth validation with Authentik OIDC

2026-08-27 12:29:23 -07:00

mem-core

Deploy Poimen Memory K8s cluster with ArgoCD tracking (M2.2, M3.5-M3.7)

2026-08-22 23:13:42 -07:00

mem-ingest

Implement M4.2: Derived filter (shingle matcher + 10 tests, 239 total)

2026-08-26 13:55:37 -07:00

mem-llm

feat(core): implement full memory pipeline (#11)

2026-08-24 01:37:16 +00:00

mem-store

feat(core): implement full memory pipeline (#11)

2026-08-24 01:37:16 +00:00