docs: document live Nexus 155 features and architecture

docs/CURRENT_CAPABILITIES.md

@@ -1,109 +1,122 @@
-# Nexus One AI — Current Capability Catalog
+# Nexus One AI - Current Capability Catalog
 
-Last verified: 21 July 2026  
-Reference environment: `172.16.10.144`  
-Portal: `https://172.16.10.144:9445`  
-Open WebUI: `https://172.16.10.144:9446`
+Last verified: 1 September 2026<br>
+Reference environment: `172.16.10.155` (`srv1`, K3s node `nexus-agent`)<br>
+Canonical portal origin: `https://nexus-dev.cezen.lan`<br>
+Detailed architecture: [NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md](NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md)<br>
+Shareable PDF: [Nexus_One_AI_Live_Features_and_Architecture_155.pdf](Nexus_One_AI_Live_Features_and_Architecture_155.pdf)
 
-This document is the presentation and product-description source of truth for
-what each visible Nexus One AI tool does. “Certified” means its core action was
-completed against the deployed backend with a real persisted result. It does
-not mean every scale, hardware, security, or production-hardening scenario has
-been certified.
+This catalog records what is visible in, or evidenced by, the current `.155`
+Enterprise Pilot environment. A visible screen is not automatically a certified
+end-to-end capability. Status is therefore expressed as **Live**, **Gated**,
+**Provision-only**, or **Known issue**.
 
 ## Product in one sentence
 
 Nexus One AI is a customer-controlled enterprise AI platform that combines
-local model inference, governed knowledge and automation workflows, evaluation,
-application development, Kubernetes operations, monitoring, and recovery behind
-one identity and portal.
+local/OpenAI-compatible inference, governed knowledge and documents, reusable
+prompts, evaluation, automation, application creation, role-based governance,
+Kubernetes operations, observability, backup and offline release controls behind
+one identity plane and portal.
 
-## User-facing AI tools
+## Build and runtime baseline
 
-| Tool | What it does | Current verified result |
+| Item | Verified state on 1 September 2026 |
+|---|---|
+| Appliance | Ubuntu 22.04.5 LTS, single-node K3s `v1.36.2+k3s1` |
+| Node | 8 vCPU, 15 GiB RAM, 392 GiB root volume, 71% used |
+| Latest signed release artifact present | `nexus-one-ai-1.0.0-rc1.15-a7bd086...tar.zst` |
+| Release model | Enterprise Pilot, Gate 10 provisional; not production-promotable |
+| Live updates | Kubernetes ConfigMap and deployment overlays continue beyond the signed RC artifact |
+| Portal / Core API / Open WebUI probes | HTTP 200 from the canonical ingress |
+| Core API / Portal / App Gateway | Two ready replicas each |
+| Daily readiness evidence | Pass, generated 31 August 2026 06:06 UTC |
+| Security evidence | Pass, generated 1 September 2026 00:00 UTC |
+| Backup evidence | Pass, generated 1 September 2026 04:55 UTC; 32 retained backups; latest 2.52 hours old |
+| Known live issue | One newer document-scanner pod is in `CrashLoopBackOff`; an older scanner replica remains ready |
+
+The server does not expose one immutable identifier that includes every
+post-release overlay. For traceability, quote both the RC artifact and this
+verification date rather than describing `.155` as a single clean release.
+
+## User workspaces
+
+| Group | Capability | Current scope and status |
 |---|---|---|
-| AI Workspace | Provides persistent multi-conversation chat with installed local models, system prompts, temperature controls, and image input where supported. | Certified with real local inference; failed model calls are shown as failures and do not fall back to simulated answers. |
-| Nexus Notebook / Knowledge Base | Uploads and indexes documents, searches ChromaDB, and answers questions using retrieved source passages. | Certified with document ingestion, vector retrieval, grounded answers, and citations. |
-| Meeting Assistant | Converts a transcript into a summary, topics, decisions, sentiment, action items, and formatted minutes. | Transcript-to-minutes flow certified with real model output. Audio transcription remains dependent on supported audio and speech-model availability. |
-| Prompt Library | Stores reusable prompts by business category, tags, and document requirements. | Certified for authenticated listing and administrative create, update, and delete operations. |
-| Prompt Studio | Builds prompts with personas, system instructions, parameters, optional document context, history, and hand-off to comparison or evaluation. | Certified with a seeded executive demo prompt and real model execution. |
-| Response Comparison | Sends the same system and user prompt to two to four installed models and displays response, latency, and token usage side by side. | Certified with genuine `phi3:mini` and `llama3.1:8b` responses. Browser history is presentation convenience, not a server-side evaluation record. |
-| Agent Studio | Defines governed multi-step agents that call models and platform tools. | Certified with a completed real agent pipeline and persisted execution result. |
-| Workflow Designer | Executes ordered AI, retrieval, transformation, and integration steps. | Certified with a real backend AI step; backend failure is surfaced and never replaced by simulated completion. |
-| Scheduled Jobs | Runs approved agent or workflow actions on a schedule or through a manual “Run now” action and stores the result. | Certified with a real manually triggered scheduled job. |
-| AI Evaluation Suite | Runs repeatable test cases through selected models and records model and judge scores for quality, relevance, and safety. | Certified with actual generation and persisted evaluation scores. |
-| RAG Quality | Measures retrieval relevance and grounded-answer quality against a selected knowledge collection. | Core page and collection integration are available; quality depends on the indexed source material and evaluation set. |
-| Feedback Review | Captures user ratings and comments, supports administrative review, and promotes useful examples into evaluation workflows. | Certified through feedback review and evaluation integration. |
-| Chat Rooms | Provides shared rooms for human discussion with `@AI` participation using local models. | Certified with authenticated room messaging and a real `@AI` response. |
-| Dataset Creation | Converts PDF, DOCX, TXT, Markdown, or CSV sources into grounded supervised examples, supports review, and publishes approved rows as JSONL. | Certified end to end: five grounded examples generated with `llama3.1:8b`, reviewed, approved, and published. Jobs now fail honestly if the requested valid sample count is not reached. |
-| Model Training | Fine-tunes a supported Hugging Face causal language model with a validated dataset and saves a PEFT LoRA adapter, tokenizer, configuration, logs, loss, and output path. | Certified on CUDA with `HuggingFaceTB/SmolLM2-135M-Instruct`, five examples, one epoch, persisted loss `4.3178`, saved adapter, reload, and GPU inference. This proves the pipeline, not production model quality. |
-| App Studio | Provides governed application projects, persistent workspaces, proposals, sessions, Git history, and isolated execution sandboxes. | Certified on Kubernetes for project access plus sandbox start, command execution, stop, persistence, and zero residual pods. |
+| AI Workspace | AI Workspace | **Live.** Open WebUI is protected by Nexus/Keycloak SSO and provides governed conversational access to approved models. General chat is not source evidence. |
+| AI Workspace | Prompt Studio | **Live.** Compose and execute prompts with expert roles, variables, local inference and durable governed prompt assets. |
+| AI Workspace | Prompt Library | **Live.** Shared and private versioned prompt assets with categories and controlled create/update actions. |
+| AI Workspace | Evaluations | **Live.** Evaluation suites, model comparison, RAG quality and feedback evidence are grouped under a governed quality workspace. |
+| Notebook | Nexus Notebook | **Live.** Private-by-default collections, source ingestion, evidence-grounded questions, citations, conversation history, source panels, outputs and exports. |
+| Notebook | Document Compare | **Live.** Durable multi-format comparison with persisted result, export and grounded AI brief. Supported pipeline evidence includes TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. |
+| Notebook | Document Digitization | **Degraded.** Local OCR, review and Notebook publication are implemented; one current scanner replica is unhealthy while a previous replica remains ready. |
+| Notebook | Datasets | **Live with execution gates.** Creates grounded examples from PDF, DOCX, TXT, Markdown and CSV; supports review and immutable publication. Training execution depends on a signed compatible runtime. |
+| Automate | Agents | **Live.** Governed multistep agents use approved tools, durable execution records and human-control boundaries. |
+| Automate | Workflows | **Live.** Ordered AI, retrieval, transformation and integration steps execute through the durable jobs plane. |
+| Automate | Schedules & Runs | **Live.** Manual and scheduled runs with job history, status and retry/error evidence. |
+| Automate | Meeting Assistant | **Live for local/reference flows.** Provider-neutral meeting evidence pipeline and approval boundary exist. Cloud providers require customer provisioning and consent. |
+| Automate | Chat Rooms | **Live.** Membership-controlled rooms support human collaboration and optional local AI/Notebook grounding. |
+| Build | App Studio | **Live Enterprise Pilot.** Projects, persistent workspaces, proposals, isolated Kubernetes previews, review, promotion, rollback and cleanup are implemented. |
+| Build | Applications | **Live.** Independently approved applications are published through the application gateway with version and lifecycle controls. |
+| Build | Template Marketplace | **Live.** Governed starter assets and extension templates support reusable application and automation building blocks. |
+| Build | Model Training | **Gated.** LoRA/training request and lifecycle surfaces exist; execution is permitted only when the signed training runtime and compatible hardware are available. |
+| Build | Developer / Jupyter / API | **Live.** JupyterHub, Python and TypeScript SDK clients, API credentials, extension templates and offline conformance assets are present. |
 
-## Integrated developer and data tools
+## Administration, governance and operations
 
-| Tool | What it does | Current verified result |
-|---|---|---|
-| Open WebUI | Full-featured local chat interface for installed Ollama models, files, conversations, and knowledge features. | Kubernetes-hosted, Nexus/Keycloak SSO enforced, legacy login disabled, data migrated, and real inference certified. |
-| JupyterLab | Interactive Python notebooks for analysis, prototyping, data preparation, and AI experimentation. | Kubernetes-hosted; notebook creation, execution, saving, persistent notebooks, and portal rendering certified. |
-| ChromaDB | Stores document embeddings and supports semantic retrieval for RAG workflows. | Kubernetes-hosted with persistent data; collection ingestion and retrieval certified. |
-| Ollama | Runs local language, vision, and embedding models on the GPU host and exposes inference APIs to Nexus services. | Five installed models visible; local generation, chat, embedding-dependent workflows, and Open WebUI integration certified. |
-| MLflow | Tracks experiments, parameters, metrics, and artifacts for model-development work. | Reachable through Nexus authentication; broader lifecycle migration and curated demo experiments remain a next phase. |
-| LangChain | Developer framework for composing retrieval, model, tool, and application workflows from Python. | Available through the notebook/developer environment; it is a library rather than a separate end-user service. |
-| FastAPI | Python API framework used by Nexus backend and custom application services. | Platform backend is deployed and serving authenticated APIs; the tool page is developer guidance. |
-| NVIDIA DCGM / nvtop | Exposes GPU health, temperature, memory, utilization, and process information for operators. | GPU, driver, CUDA, and host metrics are visible through the host operations bridge and monitoring stack. |
+| Capability | Current scope and status |
+|---|---|
+| Identity and roles | Keycloak OIDC, one canonical TLS origin, role-aware navigation and authorization for application users, developers, reviewers, auditors, operators, pack managers and administrators. |
+| Users and teams | Administrative user/team management and access boundaries. Customer LDAP/AD federation remains site-specific. |
+| Assigned Reviews | Reviewer/auditor queues support independent approval decisions for governed assets and applications. |
+| Model Catalog | Installed/approved model inventory and logical `nexus-default` routing. Inference is replaceable and may be external to the control-plane node. |
+| API Credentials | Managed programmatic credentials with role and audit controls. |
+| Connectors & MCP | Governed manifest registry, bounded capabilities, server-side secrets and authenticated MCP JSON-RPC projection. Local reference adapters are available; customer systems require provisioning and contract tests. |
+| Meeting Providers | **Provision-only** for Microsoft Teams, Zoom and Zoho Meeting until customer tenant, permissions, consent, retention and data-boundary requirements are approved. |
+| Pack Manager | Signed offline pack import, validation, acceptance, enable/disable, upgrade, rollback, removal and quarantine controls. |
+| Usage & Quotas | Department usage accounting, shared quotas and conservative accounting where providers omit usage metadata. |
+| Governance & Audit | Append-only audit ownership, activity review and support evidence. Current security evidence confirms the audit owner and encrypted K3s secrets. |
+| Guardrails & Security | Inference guardrails, secret protection, digest-pinned running core images, privilege checks, certificate monitoring and compliance scans. |
+| Platform Health | Host, Kubernetes, service, storage, backup, inference and dependency health with truthful degraded states. |
+| GPU Monitoring | Prometheus/Grafana/DCGM operational view. The `.155` control-plane node has no local GPU; telemetry can represent the associated accelerator provider. |
+| System Console | Controlled administrative infrastructure access. |
 
-## Platform, governance, and operations
+## Live architecture inventory
 
-| Capability | What it does | Current verified result |
-|---|---|---|
-| Nexus identity and access | Central authentication, roles, sessions, and SSO for Nexus and integrated applications. | Nexus login, role enforcement, Keycloak SSO, Open WebUI SSO, Grafana SSO, and unified session use certified. |
-| User and team management | Manages users, roles, teams, provisioning status, and access boundaries. | Administrative APIs and visible role enforcement are working; enterprise LDAP/AD federation is prepared but customer-specific. |
-| Model catalog and router | Lists installed models and selects a model according to task policy and configured defaults. | Installed-model discovery and multiple real inference paths certified; routing policies require workload-specific tuning. |
-| Guardrails, API keys, and audit | Controls programmatic access, records administrative and AI activity, and provides governance review surfaces. | Authentication, API key, audit, and role controls are integrated; formal security certification is a later phase. |
-| Platform health | Reports physical host, GPU, storage, model runtime, portal, Kubernetes, Harbor, and integrated-service reachability. | Host-aware health is certified; displayed services use their actual secured or Kubernetes paths. |
-| Kubernetes / K3s | Runs the portable Nexus application stack and isolated App Studio sandboxes. | Single-node K3s is healthy; scheduling, DNS, networking, storage, NVIDIA runtime, and sandbox lifecycle certified. |
-| Harbor | Stores private application images and Helm charts with TLS and Nexus OIDC. | Image push/pull/delete and private OCI chart workflows certified. |
-| Flux and Helm | Reconcile versioned Nexus releases from Harbor into Kubernetes. | Multiple immutable backend and portal upgrades reconciled successfully. |
-| Velero and MinIO | Back up Kubernetes objects and persistent data and support recovery. | Namespace restore drill certified; final filesystem-aware backup `nexus-demo-training-certified-20260721` completed 336/336 objects. |
-| Prometheus and Grafana | Collect and visualize platform, host, service, and GPU metrics. | Reachable through Nexus authentication with live targets; polished product dashboards and alerts remain a next phase. |
+| Layer | Current components |
+|---|---|
+| Edge | Traefik ingress, canonical TLS host, role-aware Nexus portal |
+| Identity | Keycloak OIDC and Nexus role enforcement |
+| Application services | Portal, Core API, Admin Extension, App Gateway, Job Scheduler, Job Worker, Open WebUI, document scanner and renderer |
+| Workspaces | JupyterHub, App Studio preview namespaces and application gateway |
+| Durable data | PostgreSQL with pgvector, RabbitMQ and MinIO |
+| Observability | Prometheus, Alertmanager, Grafana, Loki, Alloy, kube-state metrics, node/PostgreSQL/DCGM exporters |
+| Orchestration | Single-node K3s with isolated namespaces, Services, ConfigMaps, Secrets, Jobs, Deployments and StatefulSets |
+| Release and recovery | Signed offline bundles/packs, evidence timers, platform backups, restore verification and support bundles |
 
-## Demonstration boundaries
+## Demonstration and claim boundaries
 
-- The certified LoRA job is a pipeline proof using five examples and one epoch.
-  It is not evidence of production model quality.
-- Larger 7B/8B QLoRA jobs are constrained by the reference RTX 3050’s 8 GB VRAM,
-  particularly while Ollama is serving models.
-- Audio transcription, large-model training, production alerting, enterprise
-  directory federation, trusted customer certificates, and formal security or
-  performance certification need environment-specific validation.
-- The portal may display staging warnings for licensing, certificate, or its
-  legacy in-application backup indicator even when Kubernetes/Velero backups
-  exist. Presentation claims must use the verified evidence above.
+- `.155` is a development/Enterprise Pilot evidence environment, not a named
+  production release or customer sizing benchmark.
+- The latest signed RC artifact and the live Kubernetes overlays are not a
+  single immutable build. A clean source freeze and rebuilt signed media remain
+  release work.
+- Current evidence does not prove independent off-host disaster recovery,
+  prior-release upgrade/rollback, customer PKI/AD integration, formal
+  performance certification, or clean-machine Gate 11 installation.
+- Provider connectors and external meeting services are provision-only until
+  customer credentials, consent, retention and data-boundary decisions exist.
+- Model quality, throughput and concurrency depend on the selected inference
+  provider, model, quantization, context length and accelerator hardware.
+- The document-scanner rollout requires reconciliation before claiming a fully
+  healthy digitization service.
 
-## Recommended next phases
-
-1. **Presentation and sales-demo hardening** — curated demo data, dashboards,
-   a scripted presenter journey, screenshots, reset scripts, and a clean demo tenant.
-2. **Model lifecycle and quality** — dataset versioning, train/validation splits,
-   quality gates, adapter publishing/merging, model registry integration, and
-   repeatable benchmark suites.
-3. **Observability and operations** — production Grafana dashboards, alerts,
-   centralized logs, capacity policies, and backup/restore runbooks.
-4. **Security and enterprise identity** — trusted TLS, secret rotation, LDAP/AD,
-   MFA, vulnerability scans, rate limits, and formal role/access testing.
-5. **Packaging and delivery** — converge the Kubernetes application package and
-   Ubuntu/K3s appliance installer, then validate online and offline upgrade,
-   rollback, restore, and air-gapped installation paths.
-6. **Scale and acceptance testing** — concurrent users, large document sets,
-   longer agents/workflows, representative models, hardware profiles, and
-   customer UAT with explicit acceptance criteria.
-
-## Current deployed evidence
-
-- Backend: `1.0.7`
-- Portal: `1.0.9`
-- Stable core checkpoint: `nexus-demo-certification-core-20260721`
-- Final object checkpoint: `nexus-demo-certification-final-20260721`
-- Dataset/training filesystem checkpoint:
-  `nexus-demo-training-certified-20260721`
+## Recommended next actions
 
+1. Reconcile the document-scanner ReplicaSet and preserve a post-fix readiness record.
+2. Freeze live overlays into a reviewed source revision and rebuild signed release media.
+3. Complete Gate 10 acceptance and Gate 11 clean-machine/offline installation.
+4. Prove off-host backup and replacement-host restoration.
+5. Run prior-supported-release upgrade, migration and rollback qualification.
+6. Record model-specific performance and capacity baselines on each supported hardware tier.
+7. Complete customer PKI, directory federation and connector provisioning playbooks.

docs/NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md

@@ -0,0 +1,278 @@
+# Nexus One AI - Live Features and Architecture Reference
+
+**Environment:** `172.16.10.155`  
+**Evidence date:** 1 September 2026  
+**Audience:** technical buyers, solution architects, implementation teams and operators  
+**Lifecycle:** Enterprise Pilot / provisional Gate 10
+
+## 1. Purpose and evidence standard
+
+This document describes the Nexus One AI platform observed on `.155`. It is
+based on live Kubernetes inventory, the deployed portal and runtime source,
+release artifacts, health probes, and current readiness, security and backup
+evidence. It distinguishes implemented capabilities from gated, provision-only
+or unhealthy paths.
+
+The environment is not represented by one immutable version. The latest signed
+release artifact present is `1.0.0-rc1.15` at commit `a7bd086...`, while the live
+cluster contains later code/configuration overlays. Treat the verification date
+and the release artifact together as the baseline.
+
+## 2. System context
+
+Nexus One AI is an on-premises control and application plane for governed AI.
+Users enter through one TLS origin, authenticate through Keycloak, and receive
+role-filtered access to AI workspaces, enterprise knowledge, documents,
+automation, App Studio and administration. Durable state is held in PostgreSQL,
+large artifacts in MinIO, and background jobs are transported through RabbitMQ.
+AI execution is accessed through a replaceable OpenAI-compatible inference
+provider and is not required for basic control-plane availability.
+
+```text
+Users and administrators
+          |
+          v
+Traefik TLS ingress - nexus-dev.cezen.lan
+          |
+          +--> Keycloak OIDC / role authorization
+          |
+          +--> Nexus Portal
+          |       +--> AI Workspace / Open WebUI
+          |       +--> Notebook / documents / datasets / evaluations
+          |       +--> agents / workflows / schedules / meetings
+          |       +--> App Studio / applications / templates
+          |       +--> administration / audit / health / packs
+          |
+          +--> Core API <--> PostgreSQL + pgvector
+          |       |
+          |       +--> RabbitMQ --> Scheduler / Worker
+          |       +--> MinIO governed artifacts
+          |       +--> model gateway --> replaceable inference provider
+          |
+          +--> App Gateway --> isolated application previews/releases
+          +--> JupyterHub --> persistent developer workspaces
+
+Platform telemetry --> Prometheus / Alertmanager / Grafana
+Platform logs      --> Alloy / Loki / Grafana
+Recovery           --> scheduled backup evidence and restore verification
+```
+
+## 3. Live deployment topology
+
+The reference appliance is a single K3s control-plane node running Ubuntu
+22.04.5. K3s provides DNS, local-path storage, metrics and Traefik. Product
+workloads are separated into platform, data, observability, workspace and
+application-preview namespaces.
+
+### Platform namespace
+
+- Two Core API replicas provide the protected product API.
+- Two portal replicas serve the dependency-light web interface.
+- Two App Gateway replicas route approved applications and previews.
+- Keycloak provides OIDC identity and role claims.
+- Job Scheduler and Job Worker execute durable background work.
+- Open WebUI provides the approved conversational workspace behind SSO.
+- Admin Extension provides controlled administrative capabilities.
+- Document Renderer and Document Scanner isolate document processing.
+
+### Data namespace
+
+- PostgreSQL 17 with pgvector is authoritative for product, job, workflow,
+  application and audit state, and supports vector retrieval.
+- RabbitMQ transports durable work references; it is not authoritative state.
+- MinIO stores large governed objects, outputs and artifacts.
+
+### Workspace and preview namespaces
+
+- JupyterHub provides authenticated, persistent developer workspaces.
+- App Studio creates isolated preview Deployments, Services and ConfigMaps.
+- Approved applications are exposed through the App Gateway; preview resources
+  can be stopped and removed without changing the authoritative project history.
+
+### Observability namespace
+
+- Prometheus collects Kubernetes, service, host, PostgreSQL and GPU metrics.
+- Alertmanager applies warning/critical response policy.
+- Grafana provides platform, capacity, inference, GPU and database dashboards.
+- Alloy and Loki collect and retain logs.
+
+## 4. Identity, roles and access boundaries
+
+Keycloak is the central identity provider. Portal navigation and APIs apply
+roles for application users, developers, reviewers, auditors, operators, pack
+managers and platform administrators. Reviewer and read-only roles are treated
+restrictively unless an explicit operational or administrative role is also
+present.
+
+The browser never receives connector secrets. Connector and meeting-provider
+records carry server-side secret references, allowlisted hosts, bounded scopes,
+retention terms and activation state. Generated applications and packs are
+isolated and require explicit acceptance before broader availability.
+
+## 5. AI Workspace and prompt management
+
+### AI Workspace
+
+Open WebUI is integrated behind Nexus SSO for persistent conversations, local
+or approved models and file-assisted chat. The logical `nexus-default` model
+decouples applications from a specific provider. General chat output is not
+treated as governed source evidence; cited work belongs in Nexus Notebook.
+
+### Prompt Studio and Library
+
+The prompt platform stores private/shared, versioned prompt assets. Prompt
+Studio supports variables, expert personas, structured instructions, local
+inference runs and hand-off into evaluation. The live interface includes
+business, data, legal, security, content and product-management expert modes.
+
+### Evaluation and feedback
+
+Evaluation suites run repeatable cases against selected models and persist
+quality/safety evidence. The quality area also groups model comparison, RAG
+quality and reviewed user feedback. Results are evidence for model/prompt
+selection, not a universal certification of a model.
+
+## 6. Nexus Notebook and document intelligence
+
+### Knowledge workflow
+
+Collections are private by default and may be shared through controlled access.
+Sources are uploaded, extracted and indexed. Questions retrieve approved source
+segments, generate an answer and preserve citations. Conversations, source
+panels, generated outputs, exports, access management and audit links form one
+governed workspace.
+
+### Document processing flow
+
+```text
+Upload -> malware/type/size policy -> isolated extraction/OCR -> review
+       -> metadata and chunks -> PostgreSQL/pgvector + object storage
+       -> retrieval/reranking -> model generation -> cited answer/output
+```
+
+### Document Compare
+
+The current Enterprise Pilot supports durable comparisons for text and Office
+formats, including TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. Jobs
+persist the comparison, support export, and can generate a grounded AI brief.
+
+### Document Digitization
+
+The digitization path performs local OCR, assisted field extraction, human
+validation, persistence and Notebook publication. It includes Indian GST, PAN
+and tender-oriented assistance. On the evidence date, one newer scanner pod was
+crash-looping while an older scanner pod was ready; this service is therefore
+degraded pending rollout reconciliation.
+
+### Dataset creation and training
+
+Datasets can be generated from PDF, DOCX, TXT, Markdown and CSV, reviewed row by
+row, and published as immutable versions with lineage/checksum evidence.
+Training requests support governed LoRA/full/embedding choices, but execution is
+gated by signed runtime prerequisites and compatible accelerator capacity.
+
+## 7. Automation and collaboration
+
+Agents define multistep model/tool behavior under approved capabilities.
+Workflows connect AI, retrieval, transformation and integration steps.
+Schedulers and workers execute manual or timed runs and retain their history.
+Human review can be placed at consequential boundaries.
+
+Meeting Assistant uses a provider-neutral record and post-meeting evidence
+pipeline. Microsoft Teams, Zoom and Zoho Meeting are provision-only until a
+customer approves tenant permissions, consent, retention, secret and regional
+data-boundary requirements. Chat Rooms provide membership-controlled human and
+AI collaboration with optional Notebook grounding.
+
+## 8. Application and extension platform
+
+App Studio turns requirements into governed projects with persistent workspaces,
+proposals and source history. Code runs in isolated Kubernetes sandboxes.
+Preview, review, independent approval, publish, versioning, rollback and cleanup
+are separate lifecycle stages.
+
+The Pack Manager imports signed offline capability packs and validates identity,
+signature, policy, vulnerabilities and embedded-secret constraints. Accepted
+packs can be enabled, upgraded, disabled, rolled back or removed. Python and
+TypeScript SDKs, templates and an offline conformance suite support controlled
+extensions.
+
+## 9. Security and governance controls
+
+Current controls include:
+
+- encrypted K3s Secret storage and protected host-file permissions;
+- digest-pinned running core images;
+- checks against host access and privileged workload execution;
+- Keycloak OIDC, role enforcement and unified sessions;
+- append-only audit ownership and administrative activity evidence;
+- API credential governance and inference guardrails;
+- signed release/pack inventories and fail-closed validation;
+- server-side connector secrets, host allowlists and bounded capabilities;
+- certificate-expiry monitoring;
+- support-bundle redaction and recurring compliance evidence.
+
+The 1 September security record passed all recorded controls, including secret
+encryption, file modes, certificate life, workload privilege, pinned images and
+audit ownership. This is environment evidence, not an external certification.
+
+## 10. Operations, resilience and service objectives
+
+The platform publishes health, resource, inference, GPU, database, logs and job
+evidence. Operational objectives for the single-node pilot include 99.5% portal
+readiness, 95% of inference responses below 30 seconds, GPU telemetry presence,
+VRAM warning at 90%, critical at 97%, backup age below 30 hours, and successful
+daily restore verification. These are internal objectives, not contractual SLAs.
+
+The latest inspected evidence showed:
+
+- daily enterprise readiness: pass;
+- security compliance: pass;
+- backup evidence: pass;
+- 32 retained backups;
+- latest backup 2.52 hours old;
+- 28.68% backup-storage headroom;
+- portal, Core API and Open WebUI ingress probes: HTTP 200.
+
+## 11. Release and air-gapped delivery
+
+Signed offline release bundles and a bootable AMD64 pilot ISO exist. The release
+model uses digest-pinned images, source/component inventories, signed packs and
+controlled upgrade/rollback contracts. The current pilot is still provisional:
+the live overlay state must be frozen, reviewed and rebuilt into current signed
+media before production promotion.
+
+## 12. Known limitations and release gaps
+
+1. The environment is a single-node pilot and does not prove high availability.
+2. One document-scanner rollout replica is unhealthy.
+3. Independent encrypted off-host backup and replacement-host restore are not yet proven.
+4. Prior-supported-release upgrade, migration compatibility and rollback remain open.
+5. Customer production PKI and directory federation require site validation.
+6. External connectors and meeting providers require customer provisioning.
+7. Model throughput, concurrency and quality have not been certified across commercial hardware tiers.
+8. The current signed media predates some accepted live overlays.
+9. Gate 10 remains provisional and Gate 11 clean-machine installation has not started.
+
+## 13. Recommended documentation and engineering next steps
+
+1. Repair and qualify the document-scanner rollout.
+2. Create a single build manifest linking source commit, overlay versions, image digests and migration level.
+3. Freeze live changes and rebuild signed offline media.
+4. Complete clean-machine, disconnected installation and upgrade/rollback acceptance.
+5. Establish model/hardware performance matrices with explicit assumptions.
+6. Prove off-host recovery and record RPO/RTO evidence.
+7. Produce customer profiles for PKI, AD/LDAP, inference, storage and approved connectors.
+8. Maintain this reference automatically from cluster inventory and acceptance evidence.
+
+## 14. Evidence sources
+
+- Live K3s node, namespace, workload, Service and Ingress inventory from `.155`.
+- Live portal navigation and runtime source under `/srv/nexus/source/nexus-platform`.
+- Signed release artifacts under `/srv/nexus/artifacts/releases`.
+- Enterprise Pilot build status and README from release source `rc1.15-a7bd086`.
+- Readiness evidence generated 31 August 2026 06:06 UTC.
+- Security evidence generated 1 September 2026 00:00 UTC.
+- Backup evidence generated 1 September 2026 04:55 UTC.
+- Direct canonical-ingress probes for portal, Core API and Open WebUI.
+

docs/README.md

@@ -10,6 +10,9 @@ technical handoff point.
 |---|---|
 | `Nexus_One_AI_Datasheet.docx` | Editable technical buyer datasheet. |
 | `Nexus_One_AI_Datasheet.pdf` | Shareable PDF export of the technical buyer datasheet. |
+| `Nexus_One_AI_Live_Features_and_Architecture_155.pdf` | Verified technical feature and architecture reference for the current `.155` Enterprise Pilot environment. |
+| `NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md` | Editable source reference covering live topology, capabilities, evidence, limitations and next actions. |
+| `CURRENT_CAPABILITIES.md` | Concise live capability/status matrix, updated against `.155`. |
 | `architecture-overview.svg` | Simple stack view for repo pages, partner notes, and internal explainers. |
 | `technical-service-flow.svg` | Deeper service and data-path view for buyer evaluation, architecture review, and implementation planning. |