diff --git a/docs/CURRENT_CAPABILITIES.md b/docs/CURRENT_CAPABILITIES.md index 27bea6d..ed60924 100644 --- a/docs/CURRENT_CAPABILITIES.md +++ b/docs/CURRENT_CAPABILITIES.md @@ -1,109 +1,122 @@ -# Nexus One AI — Current Capability Catalog +# Nexus One AI - Current Capability Catalog -Last verified: 21 July 2026 -Reference environment: `172.16.10.144` -Portal: `https://172.16.10.144:9445` -Open WebUI: `https://172.16.10.144:9446` +Last verified: 1 September 2026
+Reference environment: `172.16.10.155` (`srv1`, K3s node `nexus-agent`)
+Canonical portal origin: `https://nexus-dev.cezen.lan`
+Detailed architecture: [NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md](NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md)
+Shareable PDF: [Nexus_One_AI_Live_Features_and_Architecture_155.pdf](Nexus_One_AI_Live_Features_and_Architecture_155.pdf) -This document is the presentation and product-description source of truth for -what each visible Nexus One AI tool does. “Certified” means its core action was -completed against the deployed backend with a real persisted result. It does -not mean every scale, hardware, security, or production-hardening scenario has -been certified. +This catalog records what is visible in, or evidenced by, the current `.155` +Enterprise Pilot environment. A visible screen is not automatically a certified +end-to-end capability. Status is therefore expressed as **Live**, **Gated**, +**Provision-only**, or **Known issue**. ## Product in one sentence Nexus One AI is a customer-controlled enterprise AI platform that combines -local model inference, governed knowledge and automation workflows, evaluation, -application development, Kubernetes operations, monitoring, and recovery behind -one identity and portal. +local/OpenAI-compatible inference, governed knowledge and documents, reusable +prompts, evaluation, automation, application creation, role-based governance, +Kubernetes operations, observability, backup and offline release controls behind +one identity plane and portal. -## User-facing AI tools +## Build and runtime baseline -| Tool | What it does | Current verified result | +| Item | Verified state on 1 September 2026 | +|---|---| +| Appliance | Ubuntu 22.04.5 LTS, single-node K3s `v1.36.2+k3s1` | +| Node | 8 vCPU, 15 GiB RAM, 392 GiB root volume, 71% used | +| Latest signed release artifact present | `nexus-one-ai-1.0.0-rc1.15-a7bd086...tar.zst` | +| Release model | Enterprise Pilot, Gate 10 provisional; not production-promotable | +| Live updates | Kubernetes ConfigMap and deployment overlays continue beyond the signed RC artifact | +| Portal / Core API / Open WebUI probes | HTTP 200 from the canonical ingress | +| Core API / Portal / App Gateway | Two ready replicas each | +| Daily readiness evidence | Pass, generated 31 August 2026 06:06 UTC | +| Security evidence | Pass, generated 1 September 2026 00:00 UTC | +| Backup evidence | Pass, generated 1 September 2026 04:55 UTC; 32 retained backups; latest 2.52 hours old | +| Known live issue | One newer document-scanner pod is in `CrashLoopBackOff`; an older scanner replica remains ready | + +The server does not expose one immutable identifier that includes every +post-release overlay. For traceability, quote both the RC artifact and this +verification date rather than describing `.155` as a single clean release. + +## User workspaces + +| Group | Capability | Current scope and status | |---|---|---| -| AI Workspace | Provides persistent multi-conversation chat with installed local models, system prompts, temperature controls, and image input where supported. | Certified with real local inference; failed model calls are shown as failures and do not fall back to simulated answers. | -| Nexus Notebook / Knowledge Base | Uploads and indexes documents, searches ChromaDB, and answers questions using retrieved source passages. | Certified with document ingestion, vector retrieval, grounded answers, and citations. | -| Meeting Assistant | Converts a transcript into a summary, topics, decisions, sentiment, action items, and formatted minutes. | Transcript-to-minutes flow certified with real model output. Audio transcription remains dependent on supported audio and speech-model availability. | -| Prompt Library | Stores reusable prompts by business category, tags, and document requirements. | Certified for authenticated listing and administrative create, update, and delete operations. | -| Prompt Studio | Builds prompts with personas, system instructions, parameters, optional document context, history, and hand-off to comparison or evaluation. | Certified with a seeded executive demo prompt and real model execution. | -| Response Comparison | Sends the same system and user prompt to two to four installed models and displays response, latency, and token usage side by side. | Certified with genuine `phi3:mini` and `llama3.1:8b` responses. Browser history is presentation convenience, not a server-side evaluation record. | -| Agent Studio | Defines governed multi-step agents that call models and platform tools. | Certified with a completed real agent pipeline and persisted execution result. | -| Workflow Designer | Executes ordered AI, retrieval, transformation, and integration steps. | Certified with a real backend AI step; backend failure is surfaced and never replaced by simulated completion. | -| Scheduled Jobs | Runs approved agent or workflow actions on a schedule or through a manual “Run now” action and stores the result. | Certified with a real manually triggered scheduled job. | -| AI Evaluation Suite | Runs repeatable test cases through selected models and records model and judge scores for quality, relevance, and safety. | Certified with actual generation and persisted evaluation scores. | -| RAG Quality | Measures retrieval relevance and grounded-answer quality against a selected knowledge collection. | Core page and collection integration are available; quality depends on the indexed source material and evaluation set. | -| Feedback Review | Captures user ratings and comments, supports administrative review, and promotes useful examples into evaluation workflows. | Certified through feedback review and evaluation integration. | -| Chat Rooms | Provides shared rooms for human discussion with `@AI` participation using local models. | Certified with authenticated room messaging and a real `@AI` response. | -| Dataset Creation | Converts PDF, DOCX, TXT, Markdown, or CSV sources into grounded supervised examples, supports review, and publishes approved rows as JSONL. | Certified end to end: five grounded examples generated with `llama3.1:8b`, reviewed, approved, and published. Jobs now fail honestly if the requested valid sample count is not reached. | -| Model Training | Fine-tunes a supported Hugging Face causal language model with a validated dataset and saves a PEFT LoRA adapter, tokenizer, configuration, logs, loss, and output path. | Certified on CUDA with `HuggingFaceTB/SmolLM2-135M-Instruct`, five examples, one epoch, persisted loss `4.3178`, saved adapter, reload, and GPU inference. This proves the pipeline, not production model quality. | -| App Studio | Provides governed application projects, persistent workspaces, proposals, sessions, Git history, and isolated execution sandboxes. | Certified on Kubernetes for project access plus sandbox start, command execution, stop, persistence, and zero residual pods. | +| AI Workspace | AI Workspace | **Live.** Open WebUI is protected by Nexus/Keycloak SSO and provides governed conversational access to approved models. General chat is not source evidence. | +| AI Workspace | Prompt Studio | **Live.** Compose and execute prompts with expert roles, variables, local inference and durable governed prompt assets. | +| AI Workspace | Prompt Library | **Live.** Shared and private versioned prompt assets with categories and controlled create/update actions. | +| AI Workspace | Evaluations | **Live.** Evaluation suites, model comparison, RAG quality and feedback evidence are grouped under a governed quality workspace. | +| Notebook | Nexus Notebook | **Live.** Private-by-default collections, source ingestion, evidence-grounded questions, citations, conversation history, source panels, outputs and exports. | +| Notebook | Document Compare | **Live.** Durable multi-format comparison with persisted result, export and grounded AI brief. Supported pipeline evidence includes TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. | +| Notebook | Document Digitization | **Degraded.** Local OCR, review and Notebook publication are implemented; one current scanner replica is unhealthy while a previous replica remains ready. | +| Notebook | Datasets | **Live with execution gates.** Creates grounded examples from PDF, DOCX, TXT, Markdown and CSV; supports review and immutable publication. Training execution depends on a signed compatible runtime. | +| Automate | Agents | **Live.** Governed multistep agents use approved tools, durable execution records and human-control boundaries. | +| Automate | Workflows | **Live.** Ordered AI, retrieval, transformation and integration steps execute through the durable jobs plane. | +| Automate | Schedules & Runs | **Live.** Manual and scheduled runs with job history, status and retry/error evidence. | +| Automate | Meeting Assistant | **Live for local/reference flows.** Provider-neutral meeting evidence pipeline and approval boundary exist. Cloud providers require customer provisioning and consent. | +| Automate | Chat Rooms | **Live.** Membership-controlled rooms support human collaboration and optional local AI/Notebook grounding. | +| Build | App Studio | **Live Enterprise Pilot.** Projects, persistent workspaces, proposals, isolated Kubernetes previews, review, promotion, rollback and cleanup are implemented. | +| Build | Applications | **Live.** Independently approved applications are published through the application gateway with version and lifecycle controls. | +| Build | Template Marketplace | **Live.** Governed starter assets and extension templates support reusable application and automation building blocks. | +| Build | Model Training | **Gated.** LoRA/training request and lifecycle surfaces exist; execution is permitted only when the signed training runtime and compatible hardware are available. | +| Build | Developer / Jupyter / API | **Live.** JupyterHub, Python and TypeScript SDK clients, API credentials, extension templates and offline conformance assets are present. | -## Integrated developer and data tools +## Administration, governance and operations -| Tool | What it does | Current verified result | -|---|---|---| -| Open WebUI | Full-featured local chat interface for installed Ollama models, files, conversations, and knowledge features. | Kubernetes-hosted, Nexus/Keycloak SSO enforced, legacy login disabled, data migrated, and real inference certified. | -| JupyterLab | Interactive Python notebooks for analysis, prototyping, data preparation, and AI experimentation. | Kubernetes-hosted; notebook creation, execution, saving, persistent notebooks, and portal rendering certified. | -| ChromaDB | Stores document embeddings and supports semantic retrieval for RAG workflows. | Kubernetes-hosted with persistent data; collection ingestion and retrieval certified. | -| Ollama | Runs local language, vision, and embedding models on the GPU host and exposes inference APIs to Nexus services. | Five installed models visible; local generation, chat, embedding-dependent workflows, and Open WebUI integration certified. | -| MLflow | Tracks experiments, parameters, metrics, and artifacts for model-development work. | Reachable through Nexus authentication; broader lifecycle migration and curated demo experiments remain a next phase. | -| LangChain | Developer framework for composing retrieval, model, tool, and application workflows from Python. | Available through the notebook/developer environment; it is a library rather than a separate end-user service. | -| FastAPI | Python API framework used by Nexus backend and custom application services. | Platform backend is deployed and serving authenticated APIs; the tool page is developer guidance. | -| NVIDIA DCGM / nvtop | Exposes GPU health, temperature, memory, utilization, and process information for operators. | GPU, driver, CUDA, and host metrics are visible through the host operations bridge and monitoring stack. | +| Capability | Current scope and status | +|---|---| +| Identity and roles | Keycloak OIDC, one canonical TLS origin, role-aware navigation and authorization for application users, developers, reviewers, auditors, operators, pack managers and administrators. | +| Users and teams | Administrative user/team management and access boundaries. Customer LDAP/AD federation remains site-specific. | +| Assigned Reviews | Reviewer/auditor queues support independent approval decisions for governed assets and applications. | +| Model Catalog | Installed/approved model inventory and logical `nexus-default` routing. Inference is replaceable and may be external to the control-plane node. | +| API Credentials | Managed programmatic credentials with role and audit controls. | +| Connectors & MCP | Governed manifest registry, bounded capabilities, server-side secrets and authenticated MCP JSON-RPC projection. Local reference adapters are available; customer systems require provisioning and contract tests. | +| Meeting Providers | **Provision-only** for Microsoft Teams, Zoom and Zoho Meeting until customer tenant, permissions, consent, retention and data-boundary requirements are approved. | +| Pack Manager | Signed offline pack import, validation, acceptance, enable/disable, upgrade, rollback, removal and quarantine controls. | +| Usage & Quotas | Department usage accounting, shared quotas and conservative accounting where providers omit usage metadata. | +| Governance & Audit | Append-only audit ownership, activity review and support evidence. Current security evidence confirms the audit owner and encrypted K3s secrets. | +| Guardrails & Security | Inference guardrails, secret protection, digest-pinned running core images, privilege checks, certificate monitoring and compliance scans. | +| Platform Health | Host, Kubernetes, service, storage, backup, inference and dependency health with truthful degraded states. | +| GPU Monitoring | Prometheus/Grafana/DCGM operational view. The `.155` control-plane node has no local GPU; telemetry can represent the associated accelerator provider. | +| System Console | Controlled administrative infrastructure access. | -## Platform, governance, and operations +## Live architecture inventory -| Capability | What it does | Current verified result | -|---|---|---| -| Nexus identity and access | Central authentication, roles, sessions, and SSO for Nexus and integrated applications. | Nexus login, role enforcement, Keycloak SSO, Open WebUI SSO, Grafana SSO, and unified session use certified. | -| User and team management | Manages users, roles, teams, provisioning status, and access boundaries. | Administrative APIs and visible role enforcement are working; enterprise LDAP/AD federation is prepared but customer-specific. | -| Model catalog and router | Lists installed models and selects a model according to task policy and configured defaults. | Installed-model discovery and multiple real inference paths certified; routing policies require workload-specific tuning. | -| Guardrails, API keys, and audit | Controls programmatic access, records administrative and AI activity, and provides governance review surfaces. | Authentication, API key, audit, and role controls are integrated; formal security certification is a later phase. | -| Platform health | Reports physical host, GPU, storage, model runtime, portal, Kubernetes, Harbor, and integrated-service reachability. | Host-aware health is certified; displayed services use their actual secured or Kubernetes paths. | -| Kubernetes / K3s | Runs the portable Nexus application stack and isolated App Studio sandboxes. | Single-node K3s is healthy; scheduling, DNS, networking, storage, NVIDIA runtime, and sandbox lifecycle certified. | -| Harbor | Stores private application images and Helm charts with TLS and Nexus OIDC. | Image push/pull/delete and private OCI chart workflows certified. | -| Flux and Helm | Reconcile versioned Nexus releases from Harbor into Kubernetes. | Multiple immutable backend and portal upgrades reconciled successfully. | -| Velero and MinIO | Back up Kubernetes objects and persistent data and support recovery. | Namespace restore drill certified; final filesystem-aware backup `nexus-demo-training-certified-20260721` completed 336/336 objects. | -| Prometheus and Grafana | Collect and visualize platform, host, service, and GPU metrics. | Reachable through Nexus authentication with live targets; polished product dashboards and alerts remain a next phase. | +| Layer | Current components | +|---|---| +| Edge | Traefik ingress, canonical TLS host, role-aware Nexus portal | +| Identity | Keycloak OIDC and Nexus role enforcement | +| Application services | Portal, Core API, Admin Extension, App Gateway, Job Scheduler, Job Worker, Open WebUI, document scanner and renderer | +| Workspaces | JupyterHub, App Studio preview namespaces and application gateway | +| Durable data | PostgreSQL with pgvector, RabbitMQ and MinIO | +| Observability | Prometheus, Alertmanager, Grafana, Loki, Alloy, kube-state metrics, node/PostgreSQL/DCGM exporters | +| Orchestration | Single-node K3s with isolated namespaces, Services, ConfigMaps, Secrets, Jobs, Deployments and StatefulSets | +| Release and recovery | Signed offline bundles/packs, evidence timers, platform backups, restore verification and support bundles | -## Demonstration boundaries +## Demonstration and claim boundaries -- The certified LoRA job is a pipeline proof using five examples and one epoch. - It is not evidence of production model quality. -- Larger 7B/8B QLoRA jobs are constrained by the reference RTX 3050’s 8 GB VRAM, - particularly while Ollama is serving models. -- Audio transcription, large-model training, production alerting, enterprise - directory federation, trusted customer certificates, and formal security or - performance certification need environment-specific validation. -- The portal may display staging warnings for licensing, certificate, or its - legacy in-application backup indicator even when Kubernetes/Velero backups - exist. Presentation claims must use the verified evidence above. +- `.155` is a development/Enterprise Pilot evidence environment, not a named + production release or customer sizing benchmark. +- The latest signed RC artifact and the live Kubernetes overlays are not a + single immutable build. A clean source freeze and rebuilt signed media remain + release work. +- Current evidence does not prove independent off-host disaster recovery, + prior-release upgrade/rollback, customer PKI/AD integration, formal + performance certification, or clean-machine Gate 11 installation. +- Provider connectors and external meeting services are provision-only until + customer credentials, consent, retention and data-boundary decisions exist. +- Model quality, throughput and concurrency depend on the selected inference + provider, model, quantization, context length and accelerator hardware. +- The document-scanner rollout requires reconciliation before claiming a fully + healthy digitization service. -## Recommended next phases - -1. **Presentation and sales-demo hardening** — curated demo data, dashboards, - a scripted presenter journey, screenshots, reset scripts, and a clean demo tenant. -2. **Model lifecycle and quality** — dataset versioning, train/validation splits, - quality gates, adapter publishing/merging, model registry integration, and - repeatable benchmark suites. -3. **Observability and operations** — production Grafana dashboards, alerts, - centralized logs, capacity policies, and backup/restore runbooks. -4. **Security and enterprise identity** — trusted TLS, secret rotation, LDAP/AD, - MFA, vulnerability scans, rate limits, and formal role/access testing. -5. **Packaging and delivery** — converge the Kubernetes application package and - Ubuntu/K3s appliance installer, then validate online and offline upgrade, - rollback, restore, and air-gapped installation paths. -6. **Scale and acceptance testing** — concurrent users, large document sets, - longer agents/workflows, representative models, hardware profiles, and - customer UAT with explicit acceptance criteria. - -## Current deployed evidence - -- Backend: `1.0.7` -- Portal: `1.0.9` -- Stable core checkpoint: `nexus-demo-certification-core-20260721` -- Final object checkpoint: `nexus-demo-certification-final-20260721` -- Dataset/training filesystem checkpoint: - `nexus-demo-training-certified-20260721` +## Recommended next actions +1. Reconcile the document-scanner ReplicaSet and preserve a post-fix readiness record. +2. Freeze live overlays into a reviewed source revision and rebuild signed release media. +3. Complete Gate 10 acceptance and Gate 11 clean-machine/offline installation. +4. Prove off-host backup and replacement-host restoration. +5. Run prior-supported-release upgrade, migration and rollback qualification. +6. Record model-specific performance and capacity baselines on each supported hardware tier. +7. Complete customer PKI, directory federation and connector provisioning playbooks. diff --git a/docs/NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md b/docs/NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md new file mode 100644 index 0000000..5daced3 --- /dev/null +++ b/docs/NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md @@ -0,0 +1,278 @@ +# Nexus One AI - Live Features and Architecture Reference + +**Environment:** `172.16.10.155` +**Evidence date:** 1 September 2026 +**Audience:** technical buyers, solution architects, implementation teams and operators +**Lifecycle:** Enterprise Pilot / provisional Gate 10 + +## 1. Purpose and evidence standard + +This document describes the Nexus One AI platform observed on `.155`. It is +based on live Kubernetes inventory, the deployed portal and runtime source, +release artifacts, health probes, and current readiness, security and backup +evidence. It distinguishes implemented capabilities from gated, provision-only +or unhealthy paths. + +The environment is not represented by one immutable version. The latest signed +release artifact present is `1.0.0-rc1.15` at commit `a7bd086...`, while the live +cluster contains later code/configuration overlays. Treat the verification date +and the release artifact together as the baseline. + +## 2. System context + +Nexus One AI is an on-premises control and application plane for governed AI. +Users enter through one TLS origin, authenticate through Keycloak, and receive +role-filtered access to AI workspaces, enterprise knowledge, documents, +automation, App Studio and administration. Durable state is held in PostgreSQL, +large artifacts in MinIO, and background jobs are transported through RabbitMQ. +AI execution is accessed through a replaceable OpenAI-compatible inference +provider and is not required for basic control-plane availability. + +```text +Users and administrators + | + v +Traefik TLS ingress - nexus-dev.cezen.lan + | + +--> Keycloak OIDC / role authorization + | + +--> Nexus Portal + | +--> AI Workspace / Open WebUI + | +--> Notebook / documents / datasets / evaluations + | +--> agents / workflows / schedules / meetings + | +--> App Studio / applications / templates + | +--> administration / audit / health / packs + | + +--> Core API <--> PostgreSQL + pgvector + | | + | +--> RabbitMQ --> Scheduler / Worker + | +--> MinIO governed artifacts + | +--> model gateway --> replaceable inference provider + | + +--> App Gateway --> isolated application previews/releases + +--> JupyterHub --> persistent developer workspaces + +Platform telemetry --> Prometheus / Alertmanager / Grafana +Platform logs --> Alloy / Loki / Grafana +Recovery --> scheduled backup evidence and restore verification +``` + +## 3. Live deployment topology + +The reference appliance is a single K3s control-plane node running Ubuntu +22.04.5. K3s provides DNS, local-path storage, metrics and Traefik. Product +workloads are separated into platform, data, observability, workspace and +application-preview namespaces. + +### Platform namespace + +- Two Core API replicas provide the protected product API. +- Two portal replicas serve the dependency-light web interface. +- Two App Gateway replicas route approved applications and previews. +- Keycloak provides OIDC identity and role claims. +- Job Scheduler and Job Worker execute durable background work. +- Open WebUI provides the approved conversational workspace behind SSO. +- Admin Extension provides controlled administrative capabilities. +- Document Renderer and Document Scanner isolate document processing. + +### Data namespace + +- PostgreSQL 17 with pgvector is authoritative for product, job, workflow, + application and audit state, and supports vector retrieval. +- RabbitMQ transports durable work references; it is not authoritative state. +- MinIO stores large governed objects, outputs and artifacts. + +### Workspace and preview namespaces + +- JupyterHub provides authenticated, persistent developer workspaces. +- App Studio creates isolated preview Deployments, Services and ConfigMaps. +- Approved applications are exposed through the App Gateway; preview resources + can be stopped and removed without changing the authoritative project history. + +### Observability namespace + +- Prometheus collects Kubernetes, service, host, PostgreSQL and GPU metrics. +- Alertmanager applies warning/critical response policy. +- Grafana provides platform, capacity, inference, GPU and database dashboards. +- Alloy and Loki collect and retain logs. + +## 4. Identity, roles and access boundaries + +Keycloak is the central identity provider. Portal navigation and APIs apply +roles for application users, developers, reviewers, auditors, operators, pack +managers and platform administrators. Reviewer and read-only roles are treated +restrictively unless an explicit operational or administrative role is also +present. + +The browser never receives connector secrets. Connector and meeting-provider +records carry server-side secret references, allowlisted hosts, bounded scopes, +retention terms and activation state. Generated applications and packs are +isolated and require explicit acceptance before broader availability. + +## 5. AI Workspace and prompt management + +### AI Workspace + +Open WebUI is integrated behind Nexus SSO for persistent conversations, local +or approved models and file-assisted chat. The logical `nexus-default` model +decouples applications from a specific provider. General chat output is not +treated as governed source evidence; cited work belongs in Nexus Notebook. + +### Prompt Studio and Library + +The prompt platform stores private/shared, versioned prompt assets. Prompt +Studio supports variables, expert personas, structured instructions, local +inference runs and hand-off into evaluation. The live interface includes +business, data, legal, security, content and product-management expert modes. + +### Evaluation and feedback + +Evaluation suites run repeatable cases against selected models and persist +quality/safety evidence. The quality area also groups model comparison, RAG +quality and reviewed user feedback. Results are evidence for model/prompt +selection, not a universal certification of a model. + +## 6. Nexus Notebook and document intelligence + +### Knowledge workflow + +Collections are private by default and may be shared through controlled access. +Sources are uploaded, extracted and indexed. Questions retrieve approved source +segments, generate an answer and preserve citations. Conversations, source +panels, generated outputs, exports, access management and audit links form one +governed workspace. + +### Document processing flow + +```text +Upload -> malware/type/size policy -> isolated extraction/OCR -> review + -> metadata and chunks -> PostgreSQL/pgvector + object storage + -> retrieval/reranking -> model generation -> cited answer/output +``` + +### Document Compare + +The current Enterprise Pilot supports durable comparisons for text and Office +formats, including TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. Jobs +persist the comparison, support export, and can generate a grounded AI brief. + +### Document Digitization + +The digitization path performs local OCR, assisted field extraction, human +validation, persistence and Notebook publication. It includes Indian GST, PAN +and tender-oriented assistance. On the evidence date, one newer scanner pod was +crash-looping while an older scanner pod was ready; this service is therefore +degraded pending rollout reconciliation. + +### Dataset creation and training + +Datasets can be generated from PDF, DOCX, TXT, Markdown and CSV, reviewed row by +row, and published as immutable versions with lineage/checksum evidence. +Training requests support governed LoRA/full/embedding choices, but execution is +gated by signed runtime prerequisites and compatible accelerator capacity. + +## 7. Automation and collaboration + +Agents define multistep model/tool behavior under approved capabilities. +Workflows connect AI, retrieval, transformation and integration steps. +Schedulers and workers execute manual or timed runs and retain their history. +Human review can be placed at consequential boundaries. + +Meeting Assistant uses a provider-neutral record and post-meeting evidence +pipeline. Microsoft Teams, Zoom and Zoho Meeting are provision-only until a +customer approves tenant permissions, consent, retention, secret and regional +data-boundary requirements. Chat Rooms provide membership-controlled human and +AI collaboration with optional Notebook grounding. + +## 8. Application and extension platform + +App Studio turns requirements into governed projects with persistent workspaces, +proposals and source history. Code runs in isolated Kubernetes sandboxes. +Preview, review, independent approval, publish, versioning, rollback and cleanup +are separate lifecycle stages. + +The Pack Manager imports signed offline capability packs and validates identity, +signature, policy, vulnerabilities and embedded-secret constraints. Accepted +packs can be enabled, upgraded, disabled, rolled back or removed. Python and +TypeScript SDKs, templates and an offline conformance suite support controlled +extensions. + +## 9. Security and governance controls + +Current controls include: + +- encrypted K3s Secret storage and protected host-file permissions; +- digest-pinned running core images; +- checks against host access and privileged workload execution; +- Keycloak OIDC, role enforcement and unified sessions; +- append-only audit ownership and administrative activity evidence; +- API credential governance and inference guardrails; +- signed release/pack inventories and fail-closed validation; +- server-side connector secrets, host allowlists and bounded capabilities; +- certificate-expiry monitoring; +- support-bundle redaction and recurring compliance evidence. + +The 1 September security record passed all recorded controls, including secret +encryption, file modes, certificate life, workload privilege, pinned images and +audit ownership. This is environment evidence, not an external certification. + +## 10. Operations, resilience and service objectives + +The platform publishes health, resource, inference, GPU, database, logs and job +evidence. Operational objectives for the single-node pilot include 99.5% portal +readiness, 95% of inference responses below 30 seconds, GPU telemetry presence, +VRAM warning at 90%, critical at 97%, backup age below 30 hours, and successful +daily restore verification. These are internal objectives, not contractual SLAs. + +The latest inspected evidence showed: + +- daily enterprise readiness: pass; +- security compliance: pass; +- backup evidence: pass; +- 32 retained backups; +- latest backup 2.52 hours old; +- 28.68% backup-storage headroom; +- portal, Core API and Open WebUI ingress probes: HTTP 200. + +## 11. Release and air-gapped delivery + +Signed offline release bundles and a bootable AMD64 pilot ISO exist. The release +model uses digest-pinned images, source/component inventories, signed packs and +controlled upgrade/rollback contracts. The current pilot is still provisional: +the live overlay state must be frozen, reviewed and rebuilt into current signed +media before production promotion. + +## 12. Known limitations and release gaps + +1. The environment is a single-node pilot and does not prove high availability. +2. One document-scanner rollout replica is unhealthy. +3. Independent encrypted off-host backup and replacement-host restore are not yet proven. +4. Prior-supported-release upgrade, migration compatibility and rollback remain open. +5. Customer production PKI and directory federation require site validation. +6. External connectors and meeting providers require customer provisioning. +7. Model throughput, concurrency and quality have not been certified across commercial hardware tiers. +8. The current signed media predates some accepted live overlays. +9. Gate 10 remains provisional and Gate 11 clean-machine installation has not started. + +## 13. Recommended documentation and engineering next steps + +1. Repair and qualify the document-scanner rollout. +2. Create a single build manifest linking source commit, overlay versions, image digests and migration level. +3. Freeze live changes and rebuild signed offline media. +4. Complete clean-machine, disconnected installation and upgrade/rollback acceptance. +5. Establish model/hardware performance matrices with explicit assumptions. +6. Prove off-host recovery and record RPO/RTO evidence. +7. Produce customer profiles for PKI, AD/LDAP, inference, storage and approved connectors. +8. Maintain this reference automatically from cluster inventory and acceptance evidence. + +## 14. Evidence sources + +- Live K3s node, namespace, workload, Service and Ingress inventory from `.155`. +- Live portal navigation and runtime source under `/srv/nexus/source/nexus-platform`. +- Signed release artifacts under `/srv/nexus/artifacts/releases`. +- Enterprise Pilot build status and README from release source `rc1.15-a7bd086`. +- Readiness evidence generated 31 August 2026 06:06 UTC. +- Security evidence generated 1 September 2026 00:00 UTC. +- Backup evidence generated 1 September 2026 04:55 UTC. +- Direct canonical-ingress probes for portal, Core API and Open WebUI. + diff --git a/docs/Nexus_One_AI_Live_Features_and_Architecture_155.pdf b/docs/Nexus_One_AI_Live_Features_and_Architecture_155.pdf new file mode 100644 index 0000000..56c4aed Binary files /dev/null and b/docs/Nexus_One_AI_Live_Features_and_Architecture_155.pdf differ diff --git a/docs/README.md b/docs/README.md index 7dd7fef..0fb7e1a 100644 --- a/docs/README.md +++ b/docs/README.md @@ -10,6 +10,9 @@ technical handoff point. |---|---| | `Nexus_One_AI_Datasheet.docx` | Editable technical buyer datasheet. | | `Nexus_One_AI_Datasheet.pdf` | Shareable PDF export of the technical buyer datasheet. | +| `Nexus_One_AI_Live_Features_and_Architecture_155.pdf` | Verified technical feature and architecture reference for the current `.155` Enterprise Pilot environment. | +| `NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md` | Editable source reference covering live topology, capabilities, evidence, limitations and next actions. | +| `CURRENT_CAPABILITIES.md` | Concise live capability/status matrix, updated against `.155`. | | `architecture-overview.svg` | Simple stack view for repo pages, partner notes, and internal explainers. | | `technical-service-flow.svg` | Deeper service and data-path view for buyer evaluation, architecture review, and implementation planning. |