diff --git a/.gitignore b/.gitignore index 153f1f7..79bebf1 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,4 @@ *.iso .DS_Store +__pycache__/ +*.pyc diff --git a/README.md b/README.md index 1ab427e..ceb3710 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,37 @@ The ISO is only one delivery surface. It stays small by pulling this package from cgit during setup, then the installer deploys the selected tier and feature set on the target server. +## Product Structure + +Nexus One AI, Powered by Cezen, has two product categories. This is a +packaging/labeling structure, not a rewrite — the existing installer, +license engine, and Server tiers below are unchanged. + +```text +Nexus One AI +Powered by Cezen +├── Nexus One AI Workstation (personal AI appliance, 1-3 users, 5 max) +│ +└── Nexus One AI Server (shared multi-user platform) + ├── Server S (was: Starter) + ├── Server M (was: Entry / Basic) + ├── Server L (was: Pro) + └── Server Max (was: Max) +``` + +- **Nexus One AI Workstation** is a personal AI appliance for AI developers, + data scientists, researchers, universities, innovation labs, CXOs, and + individual knowledge workers — typically NVIDIA DGX Spark, RTX 5090 + Workstation, or RTX PRO 6000 Workstation hardware. It is not a shared + server: no HA, no server-redundancy expectations. Internally it is an + additive `workstation` category in the license engine (`category: + "workstation"`), kept structurally separate from the Server tier ladder. +- **Nexus One AI Server** is the existing four-tier shared platform + (Server S/M/L/Max — internal license slugs `starter/basic/pro/max` are + unchanged; Server S/M/L/Max are the new commercial labels for the same + four tiers). See [Section 6](#6-tier-and-packaging-guide) and + [Section 8](#8-features-by-tier). + ## Product Collateral Technical buyer-facing collateral lives in `docs/` for reuse in customer @@ -101,7 +132,8 @@ http:// 6. Complete the setup wizard: - Network: DHCP or static IP. - License & customer details: customer name, project/customer ID, contact email, license key, support date. - - Tier: Starter, Entry, Pro, or Max. + - Tier: Server S, Server M, Server L, or Server Max (internal slugs + unchanged: `starter`/`basic`/`pro`/`max`). - Tools: keep defaults unless a component should be skipped. 7. Click **Start Installation**. 8. Wait for Phase 1 NVIDIA driver setup. The server may reboot once. @@ -215,12 +247,27 @@ The selected tier still wins, because the sale/license decision is commercial. ## 6. Tier And Packaging Guide -| Tier | Target Hardware | Typical Use | Default Models | +**Nexus One AI Server** (shared, multi-user; internal license slug in parentheses): + +| Server Tier | Target Hardware | Typical Use | Default Models | |---|---|---|---| -| Starter | 1 GPU around 24-32 GB VRAM, or constrained CPU system | Small team, RAG/admin portal, light chat | `phi3:mini`, `nomic-embed-text` | -| Entry / Basic | 1 RTX Pro 6000 class GPU, around 48-96 GB VRAM | Department deployment | `llama3.1:8b`, `mistral:7b`, `codellama:13b`, `nomic-embed-text` | -| Pro | 2+ high VRAM GPUs | Multi-team deployment, heavier coding/RAG/fine-tuning workflows | Entry models plus `llama3.1:70b`, `mixtral:8x7b`, `deepseek-coder-v2:16b` | -| Max | 4-8 enterprise GPUs such as H100/H200/A100 class | Enterprise deployment, large models, high concurrency | Pro models plus `llama3.1:405b`, `mixtral:8x22b` | +| Server S (`starter`) | 1 GPU around 24-32 GB VRAM, or constrained CPU system | Small team, RAG/admin portal, light chat | `phi3:mini`, `nomic-embed-text` | +| Server M (`basic`) | 1 RTX Pro 6000 class GPU, around 48-96 GB VRAM | Department deployment | `llama3.1:8b`, `mistral:7b`, `codellama:13b`, `nomic-embed-text` | +| Server L (`pro`) | 2+ high VRAM GPUs | Multi-team deployment, heavier coding/RAG/fine-tuning workflows | Server M models plus `llama3.1:70b`, `mixtral:8x7b`, `deepseek-coder-v2:16b` | +| Server Max (`max`) | 4-8 enterprise GPUs such as H100/H200/A100 class | Enterprise deployment, large models, high concurrency | Server L models plus `llama3.1:405b`, `mixtral:8x22b` | + +**Nexus One AI Workstation** (personal appliance; internal category `workstation`, +kept outside the Server ladder — see [Product Structure](#product-structure)): + +| Category | Target Hardware | Typical Use | Users | +|---|---|---|---| +| Workstation (`workstation`) | NVIDIA DGX Spark, RTX 5090 Workstation, or RTX PRO 6000 Workstation | Local chat, personal RAG, prompt studio, document intelligence | 1-3 active, 5 max | + +The compact single-GPU ISO build path (`build-iso-starter.sh` / +`user-data-starter`) is the closest existing hardware profile to Workstation +today. It still writes the `starter` (Server S) tier marker — repointing it to +build a dedicated Workstation ISO is tracked as follow-up work, not done in +this pass (see [Migration Notes](../MIGRATION_NOTES.md)). Large models can be pulled later. The ISO does not need to contain them. @@ -238,20 +285,20 @@ Nexus One AI includes these application features through the portal and backend: | Feature | What It Does | |---|---| | Secure admin portal | Browser UI for setup, chat, tools, users, models, reports, and system status. | -| Authentication and sessions | JWT login, role-aware admin access, brute-force lockout, active session tracking. | +| Authentication and sessions | JWT login, role-aware admin access, brute-force lockout, active session tracking. Portal nav label unchanged (no current single nav item maps to "Enterprise Authentication" — see [Section 15](#15-platform-roadmap)). | | User and team management | Admin-managed users, teams, roles, and account status. | -| Private chat | On-prem chat over local or routed models. | +| AI Workspace *(was: Private Chat)* | On-prem chat over local or routed models. | | RAG knowledge base | Upload documents, index them into ChromaDB, and query private knowledge. | -| Prompt library | Government/enterprise prompt templates grouped by use case. | -| Model management | View local models, pull Ollama models, upload GGUF models, and track model status. | +| Prompt library | Government/enterprise prompt templates grouped by use case. Kept as "Prompt Library" — the portal already has a distinct "Prompt Studio" authoring tool, so this label was not renamed to avoid duplicate nav entries. | +| Model Catalog *(was: Model Management)* | View local models, pull Ollama models, upload GGUF models, and track model status. | | Model router | Route requests by rule to local, GPU, or external model endpoints on supported tiers. | | Document intelligence | Parse, summarize, and extract structured information from documents. | | Meeting assistant | Transcript/audio processing, summaries, decisions, action items, and follow-ups. | -| Agent builder | Create and run configured agents, including scheduled agent jobs. | -| Workflow automation | Run portal workflows with HTTP, email, RAG, save-to-knowledge-base, and filter steps. | -| Connectors | Store and sync supported data connectors. | +| Agent Studio *(was: Agent Builder)* | Create and run configured agents, including scheduled agent jobs. | +| Workflow Designer *(was: Workflow Automation)* | Run portal workflows with HTTP, email, RAG, save-to-knowledge-base, and filter steps. | +| MCP & Enterprise Connectors *(was: Connectors)* | Store and sync supported data connectors (DB/folder sync today; MCP-based connectors are on the roadmap — see [Section 15](#15-platform-roadmap)). | | Guardrails | Keyword, regex, and PII checks for safer prompts and responses. | -| Analytics and audit | Query logs, usage summaries, audit reports, and admin visibility. | +| Governance & Audit *(was: Analytics and Audit)* | Query logs, usage summaries, audit reports, and admin visibility. | | Evaluation suite | Manage datasets, eval jobs, and model/prompt quality checks. | | Fine-tuning jobs | QLoRA and advanced training paths for higher tiers. | | API key manager | Create, list, and revoke API keys for integrations. | @@ -260,24 +307,31 @@ Nexus One AI includes these application features through the portal and backend: ## 8. Features By Tier -The backend exposes this same matrix from `GET /api/license`. +The backend exposes this same matrix from `GET /api/license` (now also +carrying `commercial_label` and `category` fields per tier — additive, +existing fields unchanged). -| Feature | Starter | Entry / Basic | Pro | Max | -|---|---|---|---|---| -| Max users | 10 | 25 | 100 | Custom | -| Portal | Yes | Yes | Yes | Yes | -| Private chat | Yes | Yes | Yes | Yes | -| RAG knowledge base | Yes | Yes | Advanced | Advanced | -| Meeting assistant | No | Yes | Yes | Yes | -| Workflows | Basic | Basic | Advanced | Advanced | -| Connectors | No | Limited | Yes | Yes | -| Model router | No | No | Yes | Yes | -| Audit reports | Yes | Yes | Yes | Yes | -| Backup and restore | Yes | Yes | Yes | Yes | -| Guardrails | Basic | Basic | Advanced | Advanced | -| GPU inference | No | Optional | Yes | Yes | -| Fine-tuning | No | No | QLoRA | Advanced | -| DeepSpeed / distributed training | No | No | No | Custom | +| Feature | Server S (`starter`) | Server M (`basic`) | Server L (`pro`) | Server Max (`max`) | Workstation (`workstation`) | +|---|---|---|---|---|---| +| Max users | 10 | 25 | 100 | Custom | 5 (1-3 active) | +| Portal | Yes | Yes | Yes | Yes | Yes | +| Chat / AI Workspace | Yes | Yes | Yes | Yes | Yes (local) | +| RAG knowledge base | Yes | Yes | Advanced | Advanced | Personal | +| Meeting assistant | No | Yes | Yes | Yes | No | +| Workflows | Basic | Basic | Advanced | Advanced | No | +| MCP & Enterprise Connectors | No | Limited | Yes | Yes | No | +| Model router | No | No | Yes | Yes | No | +| Governance & Audit reports | Yes | Yes | Yes | Yes | No | +| Backup and restore | Yes | Yes | Yes | Yes | Yes (local) | +| Guardrails | Basic | Basic | Advanced | Advanced | Basic | +| GPU inference | No | Optional | Yes | Yes | Yes (local) | +| Fine-tuning | No | No | QLoRA | Advanced | No | +| DeepSpeed / distributed training | No | No | No | Custom | No | +| Document intelligence / Model Catalog / Prompt Studio / API access | Per feature above | Per feature above | Per feature above | Per feature above | Yes | + +Workstation is an additive, standalone category — it is not part of the +Server S/M/L/Max ladder and cannot be reached by a Server license upgrade. +See [Product Structure](#product-structure). ## 9. What Gets Installed @@ -371,7 +425,25 @@ Before shipping to a customer, rotate these: - Any temporary portal/backend admin credentials. - Any staging license key if the final license is issued later. -## 14. Useful Files +## 15. Platform Roadmap + +Seven enterprise capabilities planned for Nexus One AI. None of these are +implemented yet — this section documents scope and current-state dependencies +so future work builds on the right foundation. Grounded in what the current +codebase does and does not already provide (confirmed by direct inspection of +`cezen-backend/main.py`, `cezen-portal/`, and this repo). + +| # | Capability | Scope | Current-state dependency | +|---|---|---|---| +| 1 | Enterprise Authentication | LDAP, Active Directory, SAML, OAuth, OIDC | Greenfield. Today's auth is username/password + JWT (`cezen-backend/main.py`), no SSO code anywhere in the stack. | +| 2 | MCP & Enterprise Connectors | SharePoint, OneDrive, SAP, Oracle, SQL, REST, GitHub, Jira, ServiceNow via MCP | Builds on today's DB/folder-sync connectors (`connectors.html`, `/api/connectors*`), which are not MCP-based. MCP is the planned future transport. | +| 3 | AI Monitoring | GPU/CPU/RAM/VRAM, latency, tokens/sec, queue depth, model usage, active sessions, health | Builds on existing `system-status.json` and `/api/metrics*` (CPU/GPU/RAM/uptime today). | +| 4 | Governance & Audit | Prompt history, model usage, compliance, PII detection, policy violations, usage reports | Builds on existing `audit.html` / `/api/audit*` (66 references in the backend today). | +| 5 | Model Catalog | Browse, install, update, rollback, versioning, recommended models | Builds on existing `models.html` / `models-admin.html` (browse/pull/upload today; no rollback/versioning yet). | +| 6 | Deployment Management | Node management, cluster health, storage, model synchronization, upgrade status, licensing overview | Greenfield for multi-node. Today's install/license flow (`install.sh`, `cezen_license.py`) is single-node. | +| 7 | Secrets Management | Secure storage for API keys, passwords, certificates, tokens, external credentials | Builds on existing API key manager (`apikeys.html` / `/api/apikeys*`); no general credential vault exists yet. | + +## 16. Useful Files ```text cgit/ diff --git a/ansible/entry.yml b/ansible/entry.yml index c89adcb..421a4f2 100644 --- a/ansible/entry.yml +++ b/ansible/entry.yml @@ -13,6 +13,7 @@ cuda_version: "12.4" skip_roles: "" # comma-separated list of role names to skip (set by install.sh) gpu_available: false + tier: "basic" # Server M (commercial label) — internal slug unchanged roles: - role: base diff --git a/ansible/roles/cezen-backend/files/cezen_license.py b/ansible/roles/cezen-backend/files/cezen_license.py index 86fb1aa..ee98fb6 100644 --- a/ansible/roles/cezen-backend/files/cezen_license.py +++ b/ansible/roles/cezen-backend/files/cezen_license.py @@ -19,10 +19,46 @@ TIER_ALIASES = { "basic tier": "basic", "pro tier": "pro", "max tier": "max", + # Server S/M/L/Max commercial labels — synonyms for the same four Server + # tiers/ranks above (starter/basic/pro/max). Additive only; TIER_ORDER and + # rank comparisons are unchanged. + "server s": "starter", + "server s tier": "starter", + "server m": "basic", + "server m tier": "basic", + "server l": "pro", + "server l tier": "pro", + "server max": "max", + "server max tier": "max", } STAGING_MAX_TIER = "basic" SUPPORTED_SIGNATURE_ALGS = {"rsa-sha256", "sha256-rsa"} +# ── Product category: Workstation (standalone, NOT part of the Server ladder) ── +# Nexus One AI Workstation is a personal AI appliance (1-3 active users, 5 max), +# distinct from the Server S/M/L/Max ladder above (TIER_ORDER). It is additive: +# it does not appear in TIER_ORDER and must never be passed through tier_rank(), +# tier_lte(), min_tier(), evaluate_license()/build_tier_options() ladder logic — +# those functions and STAGING_MAX_TIER/TIER_ALIASES above are unchanged and only +# ever resolve to one of TIER_ORDER's four Server tiers. Workstation entitlement +# is looked up independently via TIER_MATRIX["workstation"] in main.py. +WORKSTATION_TIER = "workstation" +CATEGORY_SERVER = "server" +CATEGORY_WORKSTATION = "workstation" +WORKSTATION_ALIASES = {"workstation tier", "personal", "personal ai", "nexus one ai workstation"} + + +def is_workstation_tier(value): + """True if `value` refers to the Workstation category (never a Server tier).""" + return (value or "").strip().lower() in ({WORKSTATION_TIER} | WORKSTATION_ALIASES) + + +def tier_category(value): + """Return CATEGORY_WORKSTATION or CATEGORY_SERVER for a tier/category string. + Server tiers (starter/basic/pro/max — displayed as Server S/M/L/Max) rank via + TIER_ORDER; Workstation has no rank and is resolved independently.""" + return CATEGORY_WORKSTATION if is_workstation_tier(value) else CATEGORY_SERVER + def utcnow_iso(): return datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z") diff --git a/ansible/roles/cezen-backend/files/main.py b/ansible/roles/cezen-backend/files/main.py index 21c4e29..ffda339 100644 --- a/ansible/roles/cezen-backend/files/main.py +++ b/ansible/roles/cezen-backend/files/main.py @@ -29,10 +29,15 @@ from apscheduler.triggers.cron import CronTrigger from apscheduler.triggers.interval import IntervalTrigger from cezen_license import ( STAGING_MAX_TIER, + WORKSTATION_TIER, + CATEGORY_SERVER, + CATEGORY_WORKSTATION, collect_entitlement, evaluate_license, + is_workstation_tier, normalize_tier as license_normalize_tier, read_json_file, + tier_category, tier_lte, write_json_file, ) @@ -72,6 +77,8 @@ pwd_ctx = _passlib.CryptContext(schemes=["bcrypt"], deprecated="auto") TIER_MATRIX = { "starter": { "label": "Starter", + "commercial_label": "Server S", + "category": CATEGORY_SERVER, "positioning": "Private AI entry package for one department or small team.", "max_users": 10, "features": { @@ -92,6 +99,8 @@ TIER_MATRIX = { }, "basic": { "label": "Basic", + "commercial_label": "Server M", + "category": CATEGORY_SERVER, "positioning": "Department AI suite with users, RAG, meeting assistant, and audit basics.", "max_users": 25, "features": { @@ -112,6 +121,8 @@ TIER_MATRIX = { }, "pro": { "label": "Pro", + "commercial_label": "Server L", + "category": CATEGORY_SERVER, "positioning": "Production private AI platform for multiple teams and automation workflows.", "max_users": 100, "features": { @@ -132,6 +143,8 @@ TIER_MATRIX = { }, "max": { "label": "Max", + "commercial_label": "Server Max", + "category": CATEGORY_SERVER, "positioning": "Custom high-performance AI platform for large GPU systems and enterprise controls.", "max_users": None, "features": { @@ -150,6 +163,43 @@ TIER_MATRIX = { "deepspeed": "custom", }, }, + # ── Nexus One AI Workstation — additive, standalone product category ── + # NOT part of the Server S/M/L/Max ladder: intentionally absent from + # cezen_license.TIER_ORDER, so it is unreachable through the license + # evaluation/upgrade-path ladder (_current_tier, collect_entitlement, + # build_tier_options all resolve exclusively to starter/basic/pro/max). + # This entry exists purely so the Workstation feature set is documented + # and available for future, explicitly-built activation flows to read — + # it does not change behavior for any existing Server install/license. + "workstation": { + "label": "Workstation", + "commercial_label": "Nexus One AI Workstation", + "category": CATEGORY_WORKSTATION, + "positioning": "Personal AI appliance for individual developers, researchers, and knowledge workers — not a shared server.", + "max_users": 5, + "features": { + "portal": True, + "chat": True, + "rag": "personal", + "meeting_assistant": False, + "workflows": False, + "connectors": False, + "model_router": False, + "audit_report": False, + "backup_restore": True, + "guardrails": "basic", + "gpu_inference": True, + "fine_tuning": False, + "deepspeed": False, + "document_intelligence": True, + "personal_rag": True, + "prompt_studio": True, + "model_catalog": True, + "local_ai_workspace": True, + "api_access": True, + "personal_knowledge_base": True, + }, + }, } TIER_ALIASES = { @@ -850,13 +900,22 @@ def _public_license_record(record: dict) -> dict: return public def _current_tier() -> str: + # Workstation is checked first and explicitly, rather than falling through + # to _normalize_tier() (which only knows the Server ladder and would + # silently alias an unrecognized "workstation" string to "basic"/Server M). + # This is what keeps Workstation from ever inheriting Server behavior. if CEZEN_TIER: + if is_workstation_tier(CEZEN_TIER): + return WORKSTATION_TIER return _normalize_tier(CEZEN_TIER) entitlement = _entitlement_summary() licensed_tier = (entitlement.get("licensed_tier") or "").strip() if licensed_tier: return _normalize_tier(licensed_tier) - return _normalize_tier(_setting_value("tier_label", "Basic")) + tier_label_setting = _setting_value("tier_label", "Basic") + if is_workstation_tier(tier_label_setting): + return WORKSTATION_TIER + return _normalize_tier(tier_label_setting) def _entitlement_summary(feasibility: Optional[dict] = None) -> dict: feasibility = feasibility or _cached_feasibility() @@ -876,6 +935,8 @@ def _tier_payload() -> dict: return { "tier": tier, "label": info["label"], + "commercial_label": info.get("commercial_label", info["label"]), + "category": info.get("category", CATEGORY_SERVER), "locked": bool(CEZEN_TIER or license_record.get("allowed_tier") or license_record.get("tier")), "positioning": info["positioning"], "max_users": info["max_users"], diff --git a/cezen-portal/admin.html b/cezen-portal/admin.html index 4b3d235..23973ca 100644 --- a/cezen-portal/admin.html +++ b/cezen-portal/admin.html @@ -39,12 +39,12 @@ MONITOR / Dashboard Usage Analytics - Audit Log + Governance & Audit Feedback & Ratings MANAGE / Users Teams - Model Manager + Model Catalog Training Knowledge Base TOOLS / @@ -55,7 +55,7 @@ Guardrails RAG Quality Model Router - Connectors + MCP & Enterprise Connectors SYSTEM / Appliance Ops Console @@ -67,13 +67,13 @@
INTELLIGENCE / Document Intelligence - Multimodal Chat + AI Workspace Prompt Studio Meeting Assistant AUTOMATION / - Agent Builder + Agent Studio Scheduled Jobs - Workflow Automation + Workflow Designer QUALITY / AI Eval Suite Chat Rooms diff --git a/cezen-portal/agents.html b/cezen-portal/agents.html index 351059b..9ada62f 100644 --- a/cezen-portal/agents.html +++ b/cezen-portal/agents.html @@ -3,7 +3,7 @@ - Agent Builder — Nexus One AI + Agent Studio — Nexus One AI