docs: document live Nexus 155 features and architecture
This commit is contained in:
Jino Jose committed
1 parent
4f1419ca93
commit
709c0678ec
4 files changed
+386
-92
No files matched your search
+105
-92
@@ -1,109 +1,122 @@
|
||||
# Nexus One AI — Current Capability Catalog
|
||||
# Nexus One AI - Current Capability Catalog
|
||||
|
||||
Last verified: 21 July 2026
|
||||
Reference environment: `172.16.10.144`
|
||||
Portal: `https://172.16.10.144:9445`
|
||||
Open WebUI: `https://172.16.10.144:9446`
|
||||
Last verified: 1 September 2026<br>
|
||||
Reference environment: `172.16.10.155` (`srv1`, K3s node `nexus-agent`)<br>
|
||||
Canonical portal origin: `https://nexus-dev.cezen.lan`<br>
|
||||
Detailed architecture: [NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md](NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md)<br>
|
||||
Shareable PDF: [Nexus_One_AI_Live_Features_and_Architecture_155.pdf](Nexus_One_AI_Live_Features_and_Architecture_155.pdf)
|
||||
|
||||
This document is the presentation and product-description source of truth for
|
||||
what each visible Nexus One AI tool does. “Certified” means its core action was
|
||||
completed against the deployed backend with a real persisted result. It does
|
||||
not mean every scale, hardware, security, or production-hardening scenario has
|
||||
been certified.
|
||||
This catalog records what is visible in, or evidenced by, the current `.155`
|
||||
Enterprise Pilot environment. A visible screen is not automatically a certified
|
||||
end-to-end capability. Status is therefore expressed as **Live**, **Gated**,
|
||||
**Provision-only**, or **Known issue**.
|
||||
|
||||
## Product in one sentence
|
||||
|
||||
Nexus One AI is a customer-controlled enterprise AI platform that combines
|
||||
local model inference, governed knowledge and automation workflows, evaluation,
|
||||
application development, Kubernetes operations, monitoring, and recovery behind
|
||||
one identity and portal.
|
||||
local/OpenAI-compatible inference, governed knowledge and documents, reusable
|
||||
prompts, evaluation, automation, application creation, role-based governance,
|
||||
Kubernetes operations, observability, backup and offline release controls behind
|
||||
one identity plane and portal.
|
||||
|
||||
## User-facing AI tools
|
||||
## Build and runtime baseline
|
||||
|
||||
| Tool | What it does | Current verified result |
|
||||
| Item | Verified state on 1 September 2026 |
|
||||
|---|---|
|
||||
| Appliance | Ubuntu 22.04.5 LTS, single-node K3s `v1.36.2+k3s1` |
|
||||
| Node | 8 vCPU, 15 GiB RAM, 392 GiB root volume, 71% used |
|
||||
| Latest signed release artifact present | `nexus-one-ai-1.0.0-rc1.15-a7bd086...tar.zst` |
|
||||
| Release model | Enterprise Pilot, Gate 10 provisional; not production-promotable |
|
||||
| Live updates | Kubernetes ConfigMap and deployment overlays continue beyond the signed RC artifact |
|
||||
| Portal / Core API / Open WebUI probes | HTTP 200 from the canonical ingress |
|
||||
| Core API / Portal / App Gateway | Two ready replicas each |
|
||||
| Daily readiness evidence | Pass, generated 31 August 2026 06:06 UTC |
|
||||
| Security evidence | Pass, generated 1 September 2026 00:00 UTC |
|
||||
| Backup evidence | Pass, generated 1 September 2026 04:55 UTC; 32 retained backups; latest 2.52 hours old |
|
||||
| Known live issue | One newer document-scanner pod is in `CrashLoopBackOff`; an older scanner replica remains ready |
|
||||
|
||||
The server does not expose one immutable identifier that includes every
|
||||
post-release overlay. For traceability, quote both the RC artifact and this
|
||||
verification date rather than describing `.155` as a single clean release.
|
||||
|
||||
## User workspaces
|
||||
|
||||
| Group | Capability | Current scope and status |
|
||||
|---|---|---|
|
||||
| AI Workspace | Provides persistent multi-conversation chat with installed local models, system prompts, temperature controls, and image input where supported. | Certified with real local inference; failed model calls are shown as failures and do not fall back to simulated answers. |
|
||||
| Nexus Notebook / Knowledge Base | Uploads and indexes documents, searches ChromaDB, and answers questions using retrieved source passages. | Certified with document ingestion, vector retrieval, grounded answers, and citations. |
|
||||
| Meeting Assistant | Converts a transcript into a summary, topics, decisions, sentiment, action items, and formatted minutes. | Transcript-to-minutes flow certified with real model output. Audio transcription remains dependent on supported audio and speech-model availability. |
|
||||
| Prompt Library | Stores reusable prompts by business category, tags, and document requirements. | Certified for authenticated listing and administrative create, update, and delete operations. |
|
||||
| Prompt Studio | Builds prompts with personas, system instructions, parameters, optional document context, history, and hand-off to comparison or evaluation. | Certified with a seeded executive demo prompt and real model execution. |
|
||||
| Response Comparison | Sends the same system and user prompt to two to four installed models and displays response, latency, and token usage side by side. | Certified with genuine `phi3:mini` and `llama3.1:8b` responses. Browser history is presentation convenience, not a server-side evaluation record. |
|
||||
| Agent Studio | Defines governed multi-step agents that call models and platform tools. | Certified with a completed real agent pipeline and persisted execution result. |
|
||||
| Workflow Designer | Executes ordered AI, retrieval, transformation, and integration steps. | Certified with a real backend AI step; backend failure is surfaced and never replaced by simulated completion. |
|
||||
| Scheduled Jobs | Runs approved agent or workflow actions on a schedule or through a manual “Run now” action and stores the result. | Certified with a real manually triggered scheduled job. |
|
||||
| AI Evaluation Suite | Runs repeatable test cases through selected models and records model and judge scores for quality, relevance, and safety. | Certified with actual generation and persisted evaluation scores. |
|
||||
| RAG Quality | Measures retrieval relevance and grounded-answer quality against a selected knowledge collection. | Core page and collection integration are available; quality depends on the indexed source material and evaluation set. |
|
||||
| Feedback Review | Captures user ratings and comments, supports administrative review, and promotes useful examples into evaluation workflows. | Certified through feedback review and evaluation integration. |
|
||||
| Chat Rooms | Provides shared rooms for human discussion with `@AI` participation using local models. | Certified with authenticated room messaging and a real `@AI` response. |
|
||||
| Dataset Creation | Converts PDF, DOCX, TXT, Markdown, or CSV sources into grounded supervised examples, supports review, and publishes approved rows as JSONL. | Certified end to end: five grounded examples generated with `llama3.1:8b`, reviewed, approved, and published. Jobs now fail honestly if the requested valid sample count is not reached. |
|
||||
| Model Training | Fine-tunes a supported Hugging Face causal language model with a validated dataset and saves a PEFT LoRA adapter, tokenizer, configuration, logs, loss, and output path. | Certified on CUDA with `HuggingFaceTB/SmolLM2-135M-Instruct`, five examples, one epoch, persisted loss `4.3178`, saved adapter, reload, and GPU inference. This proves the pipeline, not production model quality. |
|
||||
| App Studio | Provides governed application projects, persistent workspaces, proposals, sessions, Git history, and isolated execution sandboxes. | Certified on Kubernetes for project access plus sandbox start, command execution, stop, persistence, and zero residual pods. |
|
||||
| AI Workspace | AI Workspace | **Live.** Open WebUI is protected by Nexus/Keycloak SSO and provides governed conversational access to approved models. General chat is not source evidence. |
|
||||
| AI Workspace | Prompt Studio | **Live.** Compose and execute prompts with expert roles, variables, local inference and durable governed prompt assets. |
|
||||
| AI Workspace | Prompt Library | **Live.** Shared and private versioned prompt assets with categories and controlled create/update actions. |
|
||||
| AI Workspace | Evaluations | **Live.** Evaluation suites, model comparison, RAG quality and feedback evidence are grouped under a governed quality workspace. |
|
||||
| Notebook | Nexus Notebook | **Live.** Private-by-default collections, source ingestion, evidence-grounded questions, citations, conversation history, source panels, outputs and exports. |
|
||||
| Notebook | Document Compare | **Live.** Durable multi-format comparison with persisted result, export and grounded AI brief. Supported pipeline evidence includes TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. |
|
||||
| Notebook | Document Digitization | **Degraded.** Local OCR, review and Notebook publication are implemented; one current scanner replica is unhealthy while a previous replica remains ready. |
|
||||
| Notebook | Datasets | **Live with execution gates.** Creates grounded examples from PDF, DOCX, TXT, Markdown and CSV; supports review and immutable publication. Training execution depends on a signed compatible runtime. |
|
||||
| Automate | Agents | **Live.** Governed multistep agents use approved tools, durable execution records and human-control boundaries. |
|
||||
| Automate | Workflows | **Live.** Ordered AI, retrieval, transformation and integration steps execute through the durable jobs plane. |
|
||||
| Automate | Schedules & Runs | **Live.** Manual and scheduled runs with job history, status and retry/error evidence. |
|
||||
| Automate | Meeting Assistant | **Live for local/reference flows.** Provider-neutral meeting evidence pipeline and approval boundary exist. Cloud providers require customer provisioning and consent. |
|
||||
| Automate | Chat Rooms | **Live.** Membership-controlled rooms support human collaboration and optional local AI/Notebook grounding. |
|
||||
| Build | App Studio | **Live Enterprise Pilot.** Projects, persistent workspaces, proposals, isolated Kubernetes previews, review, promotion, rollback and cleanup are implemented. |
|
||||
| Build | Applications | **Live.** Independently approved applications are published through the application gateway with version and lifecycle controls. |
|
||||
| Build | Template Marketplace | **Live.** Governed starter assets and extension templates support reusable application and automation building blocks. |
|
||||
| Build | Model Training | **Gated.** LoRA/training request and lifecycle surfaces exist; execution is permitted only when the signed training runtime and compatible hardware are available. |
|
||||
| Build | Developer / Jupyter / API | **Live.** JupyterHub, Python and TypeScript SDK clients, API credentials, extension templates and offline conformance assets are present. |
|
||||
|
||||
## Integrated developer and data tools
|
||||
## Administration, governance and operations
|
||||
|
||||
| Tool | What it does | Current verified result |
|
||||
|---|---|---|
|
||||
| Open WebUI | Full-featured local chat interface for installed Ollama models, files, conversations, and knowledge features. | Kubernetes-hosted, Nexus/Keycloak SSO enforced, legacy login disabled, data migrated, and real inference certified. |
|
||||
| JupyterLab | Interactive Python notebooks for analysis, prototyping, data preparation, and AI experimentation. | Kubernetes-hosted; notebook creation, execution, saving, persistent notebooks, and portal rendering certified. |
|
||||
| ChromaDB | Stores document embeddings and supports semantic retrieval for RAG workflows. | Kubernetes-hosted with persistent data; collection ingestion and retrieval certified. |
|
||||
| Ollama | Runs local language, vision, and embedding models on the GPU host and exposes inference APIs to Nexus services. | Five installed models visible; local generation, chat, embedding-dependent workflows, and Open WebUI integration certified. |
|
||||
| MLflow | Tracks experiments, parameters, metrics, and artifacts for model-development work. | Reachable through Nexus authentication; broader lifecycle migration and curated demo experiments remain a next phase. |
|
||||
| LangChain | Developer framework for composing retrieval, model, tool, and application workflows from Python. | Available through the notebook/developer environment; it is a library rather than a separate end-user service. |
|
||||
| FastAPI | Python API framework used by Nexus backend and custom application services. | Platform backend is deployed and serving authenticated APIs; the tool page is developer guidance. |
|
||||
| NVIDIA DCGM / nvtop | Exposes GPU health, temperature, memory, utilization, and process information for operators. | GPU, driver, CUDA, and host metrics are visible through the host operations bridge and monitoring stack. |
|
||||
| Capability | Current scope and status |
|
||||
|---|---|
|
||||
| Identity and roles | Keycloak OIDC, one canonical TLS origin, role-aware navigation and authorization for application users, developers, reviewers, auditors, operators, pack managers and administrators. |
|
||||
| Users and teams | Administrative user/team management and access boundaries. Customer LDAP/AD federation remains site-specific. |
|
||||
| Assigned Reviews | Reviewer/auditor queues support independent approval decisions for governed assets and applications. |
|
||||
| Model Catalog | Installed/approved model inventory and logical `nexus-default` routing. Inference is replaceable and may be external to the control-plane node. |
|
||||
| API Credentials | Managed programmatic credentials with role and audit controls. |
|
||||
| Connectors & MCP | Governed manifest registry, bounded capabilities, server-side secrets and authenticated MCP JSON-RPC projection. Local reference adapters are available; customer systems require provisioning and contract tests. |
|
||||
| Meeting Providers | **Provision-only** for Microsoft Teams, Zoom and Zoho Meeting until customer tenant, permissions, consent, retention and data-boundary requirements are approved. |
|
||||
| Pack Manager | Signed offline pack import, validation, acceptance, enable/disable, upgrade, rollback, removal and quarantine controls. |
|
||||
| Usage & Quotas | Department usage accounting, shared quotas and conservative accounting where providers omit usage metadata. |
|
||||
| Governance & Audit | Append-only audit ownership, activity review and support evidence. Current security evidence confirms the audit owner and encrypted K3s secrets. |
|
||||
| Guardrails & Security | Inference guardrails, secret protection, digest-pinned running core images, privilege checks, certificate monitoring and compliance scans. |
|
||||
| Platform Health | Host, Kubernetes, service, storage, backup, inference and dependency health with truthful degraded states. |
|
||||
| GPU Monitoring | Prometheus/Grafana/DCGM operational view. The `.155` control-plane node has no local GPU; telemetry can represent the associated accelerator provider. |
|
||||
| System Console | Controlled administrative infrastructure access. |
|
||||
|
||||
## Platform, governance, and operations
|
||||
## Live architecture inventory
|
||||
|
||||
| Capability | What it does | Current verified result |
|
||||
|---|---|---|
|
||||
| Nexus identity and access | Central authentication, roles, sessions, and SSO for Nexus and integrated applications. | Nexus login, role enforcement, Keycloak SSO, Open WebUI SSO, Grafana SSO, and unified session use certified. |
|
||||
| User and team management | Manages users, roles, teams, provisioning status, and access boundaries. | Administrative APIs and visible role enforcement are working; enterprise LDAP/AD federation is prepared but customer-specific. |
|
||||
| Model catalog and router | Lists installed models and selects a model according to task policy and configured defaults. | Installed-model discovery and multiple real inference paths certified; routing policies require workload-specific tuning. |
|
||||
| Guardrails, API keys, and audit | Controls programmatic access, records administrative and AI activity, and provides governance review surfaces. | Authentication, API key, audit, and role controls are integrated; formal security certification is a later phase. |
|
||||
| Platform health | Reports physical host, GPU, storage, model runtime, portal, Kubernetes, Harbor, and integrated-service reachability. | Host-aware health is certified; displayed services use their actual secured or Kubernetes paths. |
|
||||
| Kubernetes / K3s | Runs the portable Nexus application stack and isolated App Studio sandboxes. | Single-node K3s is healthy; scheduling, DNS, networking, storage, NVIDIA runtime, and sandbox lifecycle certified. |
|
||||
| Harbor | Stores private application images and Helm charts with TLS and Nexus OIDC. | Image push/pull/delete and private OCI chart workflows certified. |
|
||||
| Flux and Helm | Reconcile versioned Nexus releases from Harbor into Kubernetes. | Multiple immutable backend and portal upgrades reconciled successfully. |
|
||||
| Velero and MinIO | Back up Kubernetes objects and persistent data and support recovery. | Namespace restore drill certified; final filesystem-aware backup `nexus-demo-training-certified-20260721` completed 336/336 objects. |
|
||||
| Prometheus and Grafana | Collect and visualize platform, host, service, and GPU metrics. | Reachable through Nexus authentication with live targets; polished product dashboards and alerts remain a next phase. |
|
||||
| Layer | Current components |
|
||||
|---|---|
|
||||
| Edge | Traefik ingress, canonical TLS host, role-aware Nexus portal |
|
||||
| Identity | Keycloak OIDC and Nexus role enforcement |
|
||||
| Application services | Portal, Core API, Admin Extension, App Gateway, Job Scheduler, Job Worker, Open WebUI, document scanner and renderer |
|
||||
| Workspaces | JupyterHub, App Studio preview namespaces and application gateway |
|
||||
| Durable data | PostgreSQL with pgvector, RabbitMQ and MinIO |
|
||||
| Observability | Prometheus, Alertmanager, Grafana, Loki, Alloy, kube-state metrics, node/PostgreSQL/DCGM exporters |
|
||||
| Orchestration | Single-node K3s with isolated namespaces, Services, ConfigMaps, Secrets, Jobs, Deployments and StatefulSets |
|
||||
| Release and recovery | Signed offline bundles/packs, evidence timers, platform backups, restore verification and support bundles |
|
||||
|
||||
## Demonstration boundaries
|
||||
## Demonstration and claim boundaries
|
||||
|
||||
- The certified LoRA job is a pipeline proof using five examples and one epoch.
|
||||
It is not evidence of production model quality.
|
||||
- Larger 7B/8B QLoRA jobs are constrained by the reference RTX 3050’s 8 GB VRAM,
|
||||
particularly while Ollama is serving models.
|
||||
- Audio transcription, large-model training, production alerting, enterprise
|
||||
directory federation, trusted customer certificates, and formal security or
|
||||
performance certification need environment-specific validation.
|
||||
- The portal may display staging warnings for licensing, certificate, or its
|
||||
legacy in-application backup indicator even when Kubernetes/Velero backups
|
||||
exist. Presentation claims must use the verified evidence above.
|
||||
- `.155` is a development/Enterprise Pilot evidence environment, not a named
|
||||
production release or customer sizing benchmark.
|
||||
- The latest signed RC artifact and the live Kubernetes overlays are not a
|
||||
single immutable build. A clean source freeze and rebuilt signed media remain
|
||||
release work.
|
||||
- Current evidence does not prove independent off-host disaster recovery,
|
||||
prior-release upgrade/rollback, customer PKI/AD integration, formal
|
||||
performance certification, or clean-machine Gate 11 installation.
|
||||
- Provider connectors and external meeting services are provision-only until
|
||||
customer credentials, consent, retention and data-boundary decisions exist.
|
||||
- Model quality, throughput and concurrency depend on the selected inference
|
||||
provider, model, quantization, context length and accelerator hardware.
|
||||
- The document-scanner rollout requires reconciliation before claiming a fully
|
||||
healthy digitization service.
|
||||
|
||||
## Recommended next phases
|
||||
|
||||
1. **Presentation and sales-demo hardening** — curated demo data, dashboards,
|
||||
a scripted presenter journey, screenshots, reset scripts, and a clean demo tenant.
|
||||
2. **Model lifecycle and quality** — dataset versioning, train/validation splits,
|
||||
quality gates, adapter publishing/merging, model registry integration, and
|
||||
repeatable benchmark suites.
|
||||
3. **Observability and operations** — production Grafana dashboards, alerts,
|
||||
centralized logs, capacity policies, and backup/restore runbooks.
|
||||
4. **Security and enterprise identity** — trusted TLS, secret rotation, LDAP/AD,
|
||||
MFA, vulnerability scans, rate limits, and formal role/access testing.
|
||||
5. **Packaging and delivery** — converge the Kubernetes application package and
|
||||
Ubuntu/K3s appliance installer, then validate online and offline upgrade,
|
||||
rollback, restore, and air-gapped installation paths.
|
||||
6. **Scale and acceptance testing** — concurrent users, large document sets,
|
||||
longer agents/workflows, representative models, hardware profiles, and
|
||||
customer UAT with explicit acceptance criteria.
|
||||
|
||||
## Current deployed evidence
|
||||
|
||||
- Backend: `1.0.7`
|
||||
- Portal: `1.0.9`
|
||||
- Stable core checkpoint: `nexus-demo-certification-core-20260721`
|
||||
- Final object checkpoint: `nexus-demo-certification-final-20260721`
|
||||
- Dataset/training filesystem checkpoint:
|
||||
`nexus-demo-training-certified-20260721`
|
||||
## Recommended next actions
|
||||
|
||||
1. Reconcile the document-scanner ReplicaSet and preserve a post-fix readiness record.
|
||||
2. Freeze live overlays into a reviewed source revision and rebuild signed release media.
|
||||
3. Complete Gate 10 acceptance and Gate 11 clean-machine/offline installation.
|
||||
4. Prove off-host backup and replacement-host restoration.
|
||||
5. Run prior-supported-release upgrade, migration and rollback qualification.
|
||||
6. Record model-specific performance and capacity baselines on each supported hardware tier.
|
||||
7. Complete customer PKI, directory federation and connector provisioning playbooks.
|
||||
Reference in new issue
Block a user