jinojose/aipackage
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document live Nexus 155 features and architecture

Browse Source
This commit is contained in:
Jino Jose committed 2026-09-01 10:50:06 +05:30
1 parent 4f1419ca93
commit 709c0678ec
4 files changed
+386 -92
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/CURRENT_CAPABILITIES.md
+105 -92
View File
@@ -1,109 +1,122 @@
# Nexus One AI — Current Capability Catalog # Nexus One AI - Current Capability Catalog
Last verified: 21 July 2026 Last verified: 1 September 2026<br>
Reference environment: `172.16.10.144` Reference environment: `172.16.10.155` (`srv1`, K3s node `nexus-agent`)<br>
Portal: `https://172.16.10.144:9445` Canonical portal origin: `https://nexus-dev.cezen.lan`<br>
Open WebUI: `https://172.16.10.144:9446` Detailed architecture: [NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md](NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md)<br>
Shareable PDF: [Nexus_One_AI_Live_Features_and_Architecture_155.pdf](Nexus_One_AI_Live_Features_and_Architecture_155.pdf)
This document is the presentation and product-description source of truth for This catalog records what is visible in, or evidenced by, the current `.155`
what each visible Nexus One AI tool does. “Certified” means its core action was Enterprise Pilot environment. A visible screen is not automatically a certified
completed against the deployed backend with a real persisted result. It does end-to-end capability. Status is therefore expressed as **Live**, **Gated**,
not mean every scale, hardware, security, or production-hardening scenario has **Provision-only**, or **Known issue**.
been certified.
## Product in one sentence ## Product in one sentence
Nexus One AI is a customer-controlled enterprise AI platform that combines Nexus One AI is a customer-controlled enterprise AI platform that combines
local model inference, governed knowledge and automation workflows, evaluation, local/OpenAI-compatible inference, governed knowledge and documents, reusable
application development, Kubernetes operations, monitoring, and recovery behind prompts, evaluation, automation, application creation, role-based governance,
one identity and portal. Kubernetes operations, observability, backup and offline release controls behind
one identity plane and portal.
## User-facing AI tools ## Build and runtime baseline
| Tool | What it does | Current verified result | | Item | Verified state on 1 September 2026 |
|---|---|
| Appliance | Ubuntu 22.04.5 LTS, single-node K3s `v1.36.2+k3s1` |
| Node | 8 vCPU, 15 GiB RAM, 392 GiB root volume, 71% used |
| Latest signed release artifact present | `nexus-one-ai-1.0.0-rc1.15-a7bd086...tar.zst` |
| Release model | Enterprise Pilot, Gate 10 provisional; not production-promotable |
| Live updates | Kubernetes ConfigMap and deployment overlays continue beyond the signed RC artifact |
| Portal / Core API / Open WebUI probes | HTTP 200 from the canonical ingress |
| Core API / Portal / App Gateway | Two ready replicas each |
| Daily readiness evidence | Pass, generated 31 August 2026 06:06 UTC |
| Security evidence | Pass, generated 1 September 2026 00:00 UTC |
| Backup evidence | Pass, generated 1 September 2026 04:55 UTC; 32 retained backups; latest 2.52 hours old |
| Known live issue | One newer document-scanner pod is in `CrashLoopBackOff`; an older scanner replica remains ready |
The server does not expose one immutable identifier that includes every
post-release overlay. For traceability, quote both the RC artifact and this
verification date rather than describing `.155` as a single clean release.
## User workspaces
| Group | Capability | Current scope and status |
|---|---|---| |---|---|---|
| AI Workspace | Provides persistent multi-conversation chat with installed local models, system prompts, temperature controls, and image input where supported. | Certified with real local inference; failed model calls are shown as failures and do not fall back to simulated answers. | | AI Workspace | AI Workspace | **Live.** Open WebUI is protected by Nexus/Keycloak SSO and provides governed conversational access to approved models. General chat is not source evidence. |
| Nexus Notebook / Knowledge Base | Uploads and indexes documents, searches ChromaDB, and answers questions using retrieved source passages. | Certified with document ingestion, vector retrieval, grounded answers, and citations. | | AI Workspace | Prompt Studio | **Live.** Compose and execute prompts with expert roles, variables, local inference and durable governed prompt assets. |
| Meeting Assistant | Converts a transcript into a summary, topics, decisions, sentiment, action items, and formatted minutes. | Transcript-to-minutes flow certified with real model output. Audio transcription remains dependent on supported audio and speech-model availability. | | AI Workspace | Prompt Library | **Live.** Shared and private versioned prompt assets with categories and controlled create/update actions. |
| Prompt Library | Stores reusable prompts by business category, tags, and document requirements. | Certified for authenticated listing and administrative create, update, and delete operations. | | AI Workspace | Evaluations | **Live.** Evaluation suites, model comparison, RAG quality and feedback evidence are grouped under a governed quality workspace. |
| Prompt Studio | Builds prompts with personas, system instructions, parameters, optional document context, history, and hand-off to comparison or evaluation. | Certified with a seeded executive demo prompt and real model execution. | | Notebook | Nexus Notebook | **Live.** Private-by-default collections, source ingestion, evidence-grounded questions, citations, conversation history, source panels, outputs and exports. |
| Response Comparison | Sends the same system and user prompt to two to four installed models and displays response, latency, and token usage side by side. | Certified with genuine `phi3:mini` and `llama3.1:8b` responses. Browser history is presentation convenience, not a server-side evaluation record. | | Notebook | Document Compare | **Live.** Durable multi-format comparison with persisted result, export and grounded AI brief. Supported pipeline evidence includes TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. |
| Agent Studio | Defines governed multi-step agents that call models and platform tools. | Certified with a completed real agent pipeline and persisted execution result. | | Notebook | Document Digitization | **Degraded.** Local OCR, review and Notebook publication are implemented; one current scanner replica is unhealthy while a previous replica remains ready. |
| Workflow Designer | Executes ordered AI, retrieval, transformation, and integration steps. | Certified with a real backend AI step; backend failure is surfaced and never replaced by simulated completion. | | Notebook | Datasets | **Live with execution gates.** Creates grounded examples from PDF, DOCX, TXT, Markdown and CSV; supports review and immutable publication. Training execution depends on a signed compatible runtime. |
| Scheduled Jobs | Runs approved agent or workflow actions on a schedule or through a manual “Run now” action and stores the result. | Certified with a real manually triggered scheduled job. | | Automate | Agents | **Live.** Governed multistep agents use approved tools, durable execution records and human-control boundaries. |
| AI Evaluation Suite | Runs repeatable test cases through selected models and records model and judge scores for quality, relevance, and safety. | Certified with actual generation and persisted evaluation scores. | | Automate | Workflows | **Live.** Ordered AI, retrieval, transformation and integration steps execute through the durable jobs plane. |
| RAG Quality | Measures retrieval relevance and grounded-answer quality against a selected knowledge collection. | Core page and collection integration are available; quality depends on the indexed source material and evaluation set. | | Automate | Schedules & Runs | **Live.** Manual and scheduled runs with job history, status and retry/error evidence. |
| Feedback Review | Captures user ratings and comments, supports administrative review, and promotes useful examples into evaluation workflows. | Certified through feedback review and evaluation integration. | | Automate | Meeting Assistant | **Live for local/reference flows.** Provider-neutral meeting evidence pipeline and approval boundary exist. Cloud providers require customer provisioning and consent. |
| Chat Rooms | Provides shared rooms for human discussion with `@AI` participation using local models. | Certified with authenticated room messaging and a real `@AI` response. | | Automate | Chat Rooms | **Live.** Membership-controlled rooms support human collaboration and optional local AI/Notebook grounding. |
| Dataset Creation | Converts PDF, DOCX, TXT, Markdown, or CSV sources into grounded supervised examples, supports review, and publishes approved rows as JSONL. | Certified end to end: five grounded examples generated with `llama3.1:8b`, reviewed, approved, and published. Jobs now fail honestly if the requested valid sample count is not reached. | | Build | App Studio | **Live Enterprise Pilot.** Projects, persistent workspaces, proposals, isolated Kubernetes previews, review, promotion, rollback and cleanup are implemented. |
| Model Training | Fine-tunes a supported Hugging Face causal language model with a validated dataset and saves a PEFT LoRA adapter, tokenizer, configuration, logs, loss, and output path. | Certified on CUDA with `HuggingFaceTB/SmolLM2-135M-Instruct`, five examples, one epoch, persisted loss `4.3178`, saved adapter, reload, and GPU inference. This proves the pipeline, not production model quality. | | Build | Applications | **Live.** Independently approved applications are published through the application gateway with version and lifecycle controls. |
| App Studio | Provides governed application projects, persistent workspaces, proposals, sessions, Git history, and isolated execution sandboxes. | Certified on Kubernetes for project access plus sandbox start, command execution, stop, persistence, and zero residual pods. | | Build | Template Marketplace | **Live.** Governed starter assets and extension templates support reusable application and automation building blocks. |
| Build | Model Training | **Gated.** LoRA/training request and lifecycle surfaces exist; execution is permitted only when the signed training runtime and compatible hardware are available. |
| Build | Developer / Jupyter / API | **Live.** JupyterHub, Python and TypeScript SDK clients, API credentials, extension templates and offline conformance assets are present. |
## Integrated developer and data tools ## Administration, governance and operations
| Tool | What it does | Current verified result | | Capability | Current scope and status |
|---|---|---| |---|---|
| Open WebUI | Full-featured local chat interface for installed Ollama models, files, conversations, and knowledge features. | Kubernetes-hosted, Nexus/Keycloak SSO enforced, legacy login disabled, data migrated, and real inference certified. | | Identity and roles | Keycloak OIDC, one canonical TLS origin, role-aware navigation and authorization for application users, developers, reviewers, auditors, operators, pack managers and administrators. |
| JupyterLab | Interactive Python notebooks for analysis, prototyping, data preparation, and AI experimentation. | Kubernetes-hosted; notebook creation, execution, saving, persistent notebooks, and portal rendering certified. | | Users and teams | Administrative user/team management and access boundaries. Customer LDAP/AD federation remains site-specific. |
| ChromaDB | Stores document embeddings and supports semantic retrieval for RAG workflows. | Kubernetes-hosted with persistent data; collection ingestion and retrieval certified. | | Assigned Reviews | Reviewer/auditor queues support independent approval decisions for governed assets and applications. |
| Ollama | Runs local language, vision, and embedding models on the GPU host and exposes inference APIs to Nexus services. | Five installed models visible; local generation, chat, embedding-dependent workflows, and Open WebUI integration certified. | | Model Catalog | Installed/approved model inventory and logical `nexus-default` routing. Inference is replaceable and may be external to the control-plane node. |
| MLflow | Tracks experiments, parameters, metrics, and artifacts for model-development work. | Reachable through Nexus authentication; broader lifecycle migration and curated demo experiments remain a next phase. | | API Credentials | Managed programmatic credentials with role and audit controls. |
| LangChain | Developer framework for composing retrieval, model, tool, and application workflows from Python. | Available through the notebook/developer environment; it is a library rather than a separate end-user service. | | Connectors & MCP | Governed manifest registry, bounded capabilities, server-side secrets and authenticated MCP JSON-RPC projection. Local reference adapters are available; customer systems require provisioning and contract tests. |
| FastAPI | Python API framework used by Nexus backend and custom application services. | Platform backend is deployed and serving authenticated APIs; the tool page is developer guidance. | | Meeting Providers | **Provision-only** for Microsoft Teams, Zoom and Zoho Meeting until customer tenant, permissions, consent, retention and data-boundary requirements are approved. |
| NVIDIA DCGM / nvtop | Exposes GPU health, temperature, memory, utilization, and process information for operators. | GPU, driver, CUDA, and host metrics are visible through the host operations bridge and monitoring stack. | | Pack Manager | Signed offline pack import, validation, acceptance, enable/disable, upgrade, rollback, removal and quarantine controls. |
| Usage & Quotas | Department usage accounting, shared quotas and conservative accounting where providers omit usage metadata. |
| Governance & Audit | Append-only audit ownership, activity review and support evidence. Current security evidence confirms the audit owner and encrypted K3s secrets. |
| Guardrails & Security | Inference guardrails, secret protection, digest-pinned running core images, privilege checks, certificate monitoring and compliance scans. |
| Platform Health | Host, Kubernetes, service, storage, backup, inference and dependency health with truthful degraded states. |
| GPU Monitoring | Prometheus/Grafana/DCGM operational view. The `.155` control-plane node has no local GPU; telemetry can represent the associated accelerator provider. |
| System Console | Controlled administrative infrastructure access. |
## Platform, governance, and operations ## Live architecture inventory
| Capability | What it does | Current verified result | | Layer | Current components |
|---|---|---| |---|---|
| Nexus identity and access | Central authentication, roles, sessions, and SSO for Nexus and integrated applications. | Nexus login, role enforcement, Keycloak SSO, Open WebUI SSO, Grafana SSO, and unified session use certified. | | Edge | Traefik ingress, canonical TLS host, role-aware Nexus portal |
| User and team management | Manages users, roles, teams, provisioning status, and access boundaries. | Administrative APIs and visible role enforcement are working; enterprise LDAP/AD federation is prepared but customer-specific. | | Identity | Keycloak OIDC and Nexus role enforcement |
| Model catalog and router | Lists installed models and selects a model according to task policy and configured defaults. | Installed-model discovery and multiple real inference paths certified; routing policies require workload-specific tuning. | | Application services | Portal, Core API, Admin Extension, App Gateway, Job Scheduler, Job Worker, Open WebUI, document scanner and renderer |
| Guardrails, API keys, and audit | Controls programmatic access, records administrative and AI activity, and provides governance review surfaces. | Authentication, API key, audit, and role controls are integrated; formal security certification is a later phase. | | Workspaces | JupyterHub, App Studio preview namespaces and application gateway |
| Platform health | Reports physical host, GPU, storage, model runtime, portal, Kubernetes, Harbor, and integrated-service reachability. | Host-aware health is certified; displayed services use their actual secured or Kubernetes paths. | | Durable data | PostgreSQL with pgvector, RabbitMQ and MinIO |
| Kubernetes / K3s | Runs the portable Nexus application stack and isolated App Studio sandboxes. | Single-node K3s is healthy; scheduling, DNS, networking, storage, NVIDIA runtime, and sandbox lifecycle certified. | | Observability | Prometheus, Alertmanager, Grafana, Loki, Alloy, kube-state metrics, node/PostgreSQL/DCGM exporters |
| Harbor | Stores private application images and Helm charts with TLS and Nexus OIDC. | Image push/pull/delete and private OCI chart workflows certified. | | Orchestration | Single-node K3s with isolated namespaces, Services, ConfigMaps, Secrets, Jobs, Deployments and StatefulSets |
| Flux and Helm | Reconcile versioned Nexus releases from Harbor into Kubernetes. | Multiple immutable backend and portal upgrades reconciled successfully. | | Release and recovery | Signed offline bundles/packs, evidence timers, platform backups, restore verification and support bundles |
| Velero and MinIO | Back up Kubernetes objects and persistent data and support recovery. | Namespace restore drill certified; final filesystem-aware backup `nexus-demo-training-certified-20260721` completed 336/336 objects. |
| Prometheus and Grafana | Collect and visualize platform, host, service, and GPU metrics. | Reachable through Nexus authentication with live targets; polished product dashboards and alerts remain a next phase. |
## Demonstration boundaries ## Demonstration and claim boundaries
- The certified LoRA job is a pipeline proof using five examples and one epoch. - `.155` is a development/Enterprise Pilot evidence environment, not a named
It is not evidence of production model quality. production release or customer sizing benchmark.
- Larger 7B/8B QLoRA jobs are constrained by the reference RTX 3050’s 8 GB VRAM, - The latest signed RC artifact and the live Kubernetes overlays are not a
particularly while Ollama is serving models. single immutable build. A clean source freeze and rebuilt signed media remain
- Audio transcription, large-model training, production alerting, enterprise release work.
directory federation, trusted customer certificates, and formal security or - Current evidence does not prove independent off-host disaster recovery,
performance certification need environment-specific validation. prior-release upgrade/rollback, customer PKI/AD integration, formal
- The portal may display staging warnings for licensing, certificate, or its performance certification, or clean-machine Gate 11 installation.
legacy in-application backup indicator even when Kubernetes/Velero backups - Provider connectors and external meeting services are provision-only until
exist. Presentation claims must use the verified evidence above. customer credentials, consent, retention and data-boundary decisions exist.
- Model quality, throughput and concurrency depend on the selected inference
provider, model, quantization, context length and accelerator hardware.
- The document-scanner rollout requires reconciliation before claiming a fully
healthy digitization service.
## Recommended next phases ## Recommended next actions
1. **Presentation and sales-demo hardening** — curated demo data, dashboards,
a scripted presenter journey, screenshots, reset scripts, and a clean demo tenant.
2. **Model lifecycle and quality** — dataset versioning, train/validation splits,
quality gates, adapter publishing/merging, model registry integration, and
repeatable benchmark suites.
3. **Observability and operations** — production Grafana dashboards, alerts,
centralized logs, capacity policies, and backup/restore runbooks.
4. **Security and enterprise identity** — trusted TLS, secret rotation, LDAP/AD,
MFA, vulnerability scans, rate limits, and formal role/access testing.
5. **Packaging and delivery** — converge the Kubernetes application package and
Ubuntu/K3s appliance installer, then validate online and offline upgrade,
rollback, restore, and air-gapped installation paths.
6. **Scale and acceptance testing** — concurrent users, large document sets,
longer agents/workflows, representative models, hardware profiles, and
customer UAT with explicit acceptance criteria.
## Current deployed evidence
- Backend: `1.0.7`
- Portal: `1.0.9`
- Stable core checkpoint: `nexus-demo-certification-core-20260721`
- Final object checkpoint: `nexus-demo-certification-final-20260721`
- Dataset/training filesystem checkpoint:
`nexus-demo-training-certified-20260721`
1. Reconcile the document-scanner ReplicaSet and preserve a post-fix readiness record.
2. Freeze live overlays into a reviewed source revision and rebuild signed release media.
3. Complete Gate 10 acceptance and Gate 11 clean-machine/offline installation.
4. Prove off-host backup and replacement-host restoration.
5. Run prior-supported-release upgrade, migration and rollback qualification.
6. Record model-specific performance and capacity baselines on each supported hardware tier.
7. Complete customer PKI, directory federation and connector provisioning playbooks.
docs/NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md
+278
View File
@@ -0,0 +1,278 @@
# Nexus One AI - Live Features and Architecture Reference
**Environment:** `172.16.10.155`
**Evidence date:** 1 September 2026
**Audience:** technical buyers, solution architects, implementation teams and operators
**Lifecycle:** Enterprise Pilot / provisional Gate 10
## 1. Purpose and evidence standard
This document describes the Nexus One AI platform observed on `.155`. It is
based on live Kubernetes inventory, the deployed portal and runtime source,
release artifacts, health probes, and current readiness, security and backup
evidence. It distinguishes implemented capabilities from gated, provision-only
or unhealthy paths.
The environment is not represented by one immutable version. The latest signed
release artifact present is `1.0.0-rc1.15` at commit `a7bd086...`, while the live
cluster contains later code/configuration overlays. Treat the verification date
and the release artifact together as the baseline.
## 2. System context
Nexus One AI is an on-premises control and application plane for governed AI.
Users enter through one TLS origin, authenticate through Keycloak, and receive
role-filtered access to AI workspaces, enterprise knowledge, documents,
automation, App Studio and administration. Durable state is held in PostgreSQL,
large artifacts in MinIO, and background jobs are transported through RabbitMQ.
AI execution is accessed through a replaceable OpenAI-compatible inference
provider and is not required for basic control-plane availability.
```text
Users and administrators
|
v
Traefik TLS ingress - nexus-dev.cezen.lan
|
+--> Keycloak OIDC / role authorization
|
+--> Nexus Portal
| +--> AI Workspace / Open WebUI
| +--> Notebook / documents / datasets / evaluations
| +--> agents / workflows / schedules / meetings
| +--> App Studio / applications / templates
| +--> administration / audit / health / packs
|
+--> Core API <--> PostgreSQL + pgvector
| |
| +--> RabbitMQ --> Scheduler / Worker
| +--> MinIO governed artifacts
| +--> model gateway --> replaceable inference provider
|
+--> App Gateway --> isolated application previews/releases
+--> JupyterHub --> persistent developer workspaces
Platform telemetry --> Prometheus / Alertmanager / Grafana
Platform logs --> Alloy / Loki / Grafana
Recovery --> scheduled backup evidence and restore verification
```
## 3. Live deployment topology
The reference appliance is a single K3s control-plane node running Ubuntu
22.04.5. K3s provides DNS, local-path storage, metrics and Traefik. Product
workloads are separated into platform, data, observability, workspace and
application-preview namespaces.
### Platform namespace
- Two Core API replicas provide the protected product API.
- Two portal replicas serve the dependency-light web interface.
- Two App Gateway replicas route approved applications and previews.
- Keycloak provides OIDC identity and role claims.
- Job Scheduler and Job Worker execute durable background work.
- Open WebUI provides the approved conversational workspace behind SSO.
- Admin Extension provides controlled administrative capabilities.
- Document Renderer and Document Scanner isolate document processing.
### Data namespace
- PostgreSQL 17 with pgvector is authoritative for product, job, workflow,
application and audit state, and supports vector retrieval.
- RabbitMQ transports durable work references; it is not authoritative state.
- MinIO stores large governed objects, outputs and artifacts.
### Workspace and preview namespaces
- JupyterHub provides authenticated, persistent developer workspaces.
- App Studio creates isolated preview Deployments, Services and ConfigMaps.
- Approved applications are exposed through the App Gateway; preview resources
can be stopped and removed without changing the authoritative project history.
### Observability namespace
- Prometheus collects Kubernetes, service, host, PostgreSQL and GPU metrics.
- Alertmanager applies warning/critical response policy.
- Grafana provides platform, capacity, inference, GPU and database dashboards.
- Alloy and Loki collect and retain logs.
## 4. Identity, roles and access boundaries
Keycloak is the central identity provider. Portal navigation and APIs apply
roles for application users, developers, reviewers, auditors, operators, pack
managers and platform administrators. Reviewer and read-only roles are treated
restrictively unless an explicit operational or administrative role is also
present.
The browser never receives connector secrets. Connector and meeting-provider
records carry server-side secret references, allowlisted hosts, bounded scopes,
retention terms and activation state. Generated applications and packs are
isolated and require explicit acceptance before broader availability.
## 5. AI Workspace and prompt management
### AI Workspace
Open WebUI is integrated behind Nexus SSO for persistent conversations, local
or approved models and file-assisted chat. The logical `nexus-default` model
decouples applications from a specific provider. General chat output is not
treated as governed source evidence; cited work belongs in Nexus Notebook.
### Prompt Studio and Library
The prompt platform stores private/shared, versioned prompt assets. Prompt
Studio supports variables, expert personas, structured instructions, local
inference runs and hand-off into evaluation. The live interface includes
business, data, legal, security, content and product-management expert modes.
### Evaluation and feedback
Evaluation suites run repeatable cases against selected models and persist
quality/safety evidence. The quality area also groups model comparison, RAG
quality and reviewed user feedback. Results are evidence for model/prompt
selection, not a universal certification of a model.
## 6. Nexus Notebook and document intelligence
### Knowledge workflow
Collections are private by default and may be shared through controlled access.
Sources are uploaded, extracted and indexed. Questions retrieve approved source
segments, generate an answer and preserve citations. Conversations, source
panels, generated outputs, exports, access management and audit links form one
governed workspace.
### Document processing flow
```text
Upload -> malware/type/size policy -> isolated extraction/OCR -> review
-> metadata and chunks -> PostgreSQL/pgvector + object storage
-> retrieval/reranking -> model generation -> cited answer/output
```
### Document Compare
The current Enterprise Pilot supports durable comparisons for text and Office
formats, including TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. Jobs
persist the comparison, support export, and can generate a grounded AI brief.
### Document Digitization
The digitization path performs local OCR, assisted field extraction, human
validation, persistence and Notebook publication. It includes Indian GST, PAN
and tender-oriented assistance. On the evidence date, one newer scanner pod was
crash-looping while an older scanner pod was ready; this service is therefore
degraded pending rollout reconciliation.
### Dataset creation and training
Datasets can be generated from PDF, DOCX, TXT, Markdown and CSV, reviewed row by
row, and published as immutable versions with lineage/checksum evidence.
Training requests support governed LoRA/full/embedding choices, but execution is
gated by signed runtime prerequisites and compatible accelerator capacity.
## 7. Automation and collaboration
Agents define multistep model/tool behavior under approved capabilities.
Workflows connect AI, retrieval, transformation and integration steps.
Schedulers and workers execute manual or timed runs and retain their history.
Human review can be placed at consequential boundaries.
Meeting Assistant uses a provider-neutral record and post-meeting evidence
pipeline. Microsoft Teams, Zoom and Zoho Meeting are provision-only until a
customer approves tenant permissions, consent, retention, secret and regional
data-boundary requirements. Chat Rooms provide membership-controlled human and
AI collaboration with optional Notebook grounding.
## 8. Application and extension platform
App Studio turns requirements into governed projects with persistent workspaces,
proposals and source history. Code runs in isolated Kubernetes sandboxes.
Preview, review, independent approval, publish, versioning, rollback and cleanup
are separate lifecycle stages.
The Pack Manager imports signed offline capability packs and validates identity,
signature, policy, vulnerabilities and embedded-secret constraints. Accepted
packs can be enabled, upgraded, disabled, rolled back or removed. Python and
TypeScript SDKs, templates and an offline conformance suite support controlled
extensions.
## 9. Security and governance controls
Current controls include:
- encrypted K3s Secret storage and protected host-file permissions;
- digest-pinned running core images;
- checks against host access and privileged workload execution;
- Keycloak OIDC, role enforcement and unified sessions;
- append-only audit ownership and administrative activity evidence;
- API credential governance and inference guardrails;
- signed release/pack inventories and fail-closed validation;
- server-side connector secrets, host allowlists and bounded capabilities;
- certificate-expiry monitoring;
- support-bundle redaction and recurring compliance evidence.
The 1 September security record passed all recorded controls, including secret
encryption, file modes, certificate life, workload privilege, pinned images and
audit ownership. This is environment evidence, not an external certification.
## 10. Operations, resilience and service objectives
The platform publishes health, resource, inference, GPU, database, logs and job
evidence. Operational objectives for the single-node pilot include 99.5% portal
readiness, 95% of inference responses below 30 seconds, GPU telemetry presence,
VRAM warning at 90%, critical at 97%, backup age below 30 hours, and successful
daily restore verification. These are internal objectives, not contractual SLAs.
The latest inspected evidence showed:
- daily enterprise readiness: pass;
- security compliance: pass;
- backup evidence: pass;
- 32 retained backups;
- latest backup 2.52 hours old;
- 28.68% backup-storage headroom;
- portal, Core API and Open WebUI ingress probes: HTTP 200.
## 11. Release and air-gapped delivery
Signed offline release bundles and a bootable AMD64 pilot ISO exist. The release
model uses digest-pinned images, source/component inventories, signed packs and
controlled upgrade/rollback contracts. The current pilot is still provisional:
the live overlay state must be frozen, reviewed and rebuilt into current signed
media before production promotion.
## 12. Known limitations and release gaps
1. The environment is a single-node pilot and does not prove high availability.
2. One document-scanner rollout replica is unhealthy.
3. Independent encrypted off-host backup and replacement-host restore are not yet proven.
4. Prior-supported-release upgrade, migration compatibility and rollback remain open.
5. Customer production PKI and directory federation require site validation.
6. External connectors and meeting providers require customer provisioning.
7. Model throughput, concurrency and quality have not been certified across commercial hardware tiers.
8. The current signed media predates some accepted live overlays.
9. Gate 10 remains provisional and Gate 11 clean-machine installation has not started.
## 13. Recommended documentation and engineering next steps
1. Repair and qualify the document-scanner rollout.
2. Create a single build manifest linking source commit, overlay versions, image digests and migration level.
3. Freeze live changes and rebuild signed offline media.
4. Complete clean-machine, disconnected installation and upgrade/rollback acceptance.
5. Establish model/hardware performance matrices with explicit assumptions.
6. Prove off-host recovery and record RPO/RTO evidence.
7. Produce customer profiles for PKI, AD/LDAP, inference, storage and approved connectors.
8. Maintain this reference automatically from cluster inventory and acceptance evidence.
## 14. Evidence sources
- Live K3s node, namespace, workload, Service and Ingress inventory from `.155`.
- Live portal navigation and runtime source under `/srv/nexus/source/nexus-platform`.
- Signed release artifacts under `/srv/nexus/artifacts/releases`.
- Enterprise Pilot build status and README from release source `rc1.15-a7bd086`.
- Readiness evidence generated 31 August 2026 06:06 UTC.
- Security evidence generated 1 September 2026 00:00 UTC.
- Backup evidence generated 1 September 2026 04:55 UTC.
- Direct canonical-ingress probes for portal, Core API and Open WebUI.
docs/Nexus_One_AI_Live_Features_and_Architecture_155.pdf
BIN
View File
Binary file not shown.
docs/README.md
+3
View File
@@ -10,6 +10,9 @@ technical handoff point.
|---|---| |---|---|
| `Nexus_One_AI_Datasheet.docx` | Editable technical buyer datasheet. | | `Nexus_One_AI_Datasheet.docx` | Editable technical buyer datasheet. |
| `Nexus_One_AI_Datasheet.pdf` | Shareable PDF export of the technical buyer datasheet. | | `Nexus_One_AI_Datasheet.pdf` | Shareable PDF export of the technical buyer datasheet. |
| `Nexus_One_AI_Live_Features_and_Architecture_155.pdf` | Verified technical feature and architecture reference for the current `.155` Enterprise Pilot environment. |
| `NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md` | Editable source reference covering live topology, capabilities, evidence, limitations and next actions. |
| `CURRENT_CAPABILITIES.md` | Concise live capability/status matrix, updated against `.155`. |
| `architecture-overview.svg` | Simple stack view for repo pages, partner notes, and internal explainers. | | `architecture-overview.svg` | Simple stack view for repo pages, partner notes, and internal explainers. |
| `technical-service-flow.svg` | Deeper service and data-path view for buyer evaluation, architecture review, and implementation planning. | | `technical-service-flow.svg` | Deeper service and data-path view for buyer evaluation, architecture review, and implementation planning. |