9.9 KiB
9.9 KiB
Nexus One AI - Current Capability Catalog
Last verified: 1 September 2026
Reference environment: 172.16.10.155 (srv1, K3s node nexus-agent)
Canonical portal origin: https://nexus-dev.cezen.lan
Detailed architecture: NEXUS_ONE_AI_LIVE_TECHNICAL_REFERENCE_155.md
Shareable PDF: Nexus_One_AI_Live_Features_and_Architecture_155.pdf
This catalog records what is visible in, or evidenced by, the current .155
Enterprise Pilot environment. A visible screen is not automatically a certified
end-to-end capability. Status is therefore expressed as Live, Gated,
Provision-only, or Known issue.
Product in one sentence
Nexus One AI is a customer-controlled enterprise AI platform that combines local/OpenAI-compatible inference, governed knowledge and documents, reusable prompts, evaluation, automation, application creation, role-based governance, Kubernetes operations, observability, backup and offline release controls behind one identity plane and portal.
Build and runtime baseline
| Item | Verified state on 1 September 2026 |
|---|---|
| Appliance | Ubuntu 22.04.5 LTS, single-node K3s v1.36.2+k3s1 |
| Node | 8 vCPU, 15 GiB RAM, 392 GiB root volume, 71% used |
| Latest signed release artifact present | nexus-one-ai-1.0.0-rc1.15-a7bd086...tar.zst |
| Release model | Enterprise Pilot, Gate 10 provisional; not production-promotable |
| Live updates | Kubernetes ConfigMap and deployment overlays continue beyond the signed RC artifact |
| Portal / Core API / Open WebUI probes | HTTP 200 from the canonical ingress |
| Core API / Portal / App Gateway | Two ready replicas each |
| Daily readiness evidence | Pass, generated 31 August 2026 06:06 UTC |
| Security evidence | Pass, generated 1 September 2026 00:00 UTC |
| Backup evidence | Pass, generated 1 September 2026 04:55 UTC; 32 retained backups; latest 2.52 hours old |
| Known live issue | One newer document-scanner pod is in CrashLoopBackOff; an older scanner replica remains ready |
The server does not expose one immutable identifier that includes every
post-release overlay. For traceability, quote both the RC artifact and this
verification date rather than describing .155 as a single clean release.
User workspaces
| Group | Capability | Current scope and status |
|---|---|---|
| AI Workspace | AI Workspace | Live. Open WebUI is protected by Nexus/Keycloak SSO and provides governed conversational access to approved models. General chat is not source evidence. |
| AI Workspace | Prompt Studio | Live. Compose and execute prompts with expert roles, variables, local inference and durable governed prompt assets. |
| AI Workspace | Prompt Library | Live. Shared and private versioned prompt assets with categories and controlled create/update actions. |
| AI Workspace | Evaluations | Live. Evaluation suites, model comparison, RAG quality and feedback evidence are grouped under a governed quality workspace. |
| Notebook | Nexus Notebook | Live. Private-by-default collections, source ingestion, evidence-grounded questions, citations, conversation history, source panels, outputs and exports. |
| Notebook | Document Compare | Live. Durable multi-format comparison with persisted result, export and grounded AI brief. Supported pipeline evidence includes TXT, Markdown, CSV, JSON, PDF, DOCX, XLSX and PPTX. |
| Notebook | Document Digitization | Degraded. Local OCR, review and Notebook publication are implemented; one current scanner replica is unhealthy while a previous replica remains ready. |
| Notebook | Datasets | Live with execution gates. Creates grounded examples from PDF, DOCX, TXT, Markdown and CSV; supports review and immutable publication. Training execution depends on a signed compatible runtime. |
| Automate | Agents | Live. Governed multistep agents use approved tools, durable execution records and human-control boundaries. |
| Automate | Workflows | Live. Ordered AI, retrieval, transformation and integration steps execute through the durable jobs plane. |
| Automate | Schedules & Runs | Live. Manual and scheduled runs with job history, status and retry/error evidence. |
| Automate | Meeting Assistant | Live for local/reference flows. Provider-neutral meeting evidence pipeline and approval boundary exist. Cloud providers require customer provisioning and consent. |
| Automate | Chat Rooms | Live. Membership-controlled rooms support human collaboration and optional local AI/Notebook grounding. |
| Build | App Studio | Live Enterprise Pilot. Projects, persistent workspaces, proposals, isolated Kubernetes previews, review, promotion, rollback and cleanup are implemented. |
| Build | Applications | Live. Independently approved applications are published through the application gateway with version and lifecycle controls. |
| Build | Template Marketplace | Live. Governed starter assets and extension templates support reusable application and automation building blocks. |
| Build | Model Training | Gated. LoRA/training request and lifecycle surfaces exist; execution is permitted only when the signed training runtime and compatible hardware are available. |
| Build | Developer / Jupyter / API | Live. JupyterHub, Python and TypeScript SDK clients, API credentials, extension templates and offline conformance assets are present. |
Administration, governance and operations
| Capability | Current scope and status |
|---|---|
| Identity and roles | Keycloak OIDC, one canonical TLS origin, role-aware navigation and authorization for application users, developers, reviewers, auditors, operators, pack managers and administrators. |
| Users and teams | Administrative user/team management and access boundaries. Customer LDAP/AD federation remains site-specific. |
| Assigned Reviews | Reviewer/auditor queues support independent approval decisions for governed assets and applications. |
| Model Catalog | Installed/approved model inventory and logical nexus-default routing. Inference is replaceable and may be external to the control-plane node. |
| API Credentials | Managed programmatic credentials with role and audit controls. |
| Connectors & MCP | Governed manifest registry, bounded capabilities, server-side secrets and authenticated MCP JSON-RPC projection. Local reference adapters are available; customer systems require provisioning and contract tests. |
| Meeting Providers | Provision-only for Microsoft Teams, Zoom and Zoho Meeting until customer tenant, permissions, consent, retention and data-boundary requirements are approved. |
| Pack Manager | Signed offline pack import, validation, acceptance, enable/disable, upgrade, rollback, removal and quarantine controls. |
| Usage & Quotas | Department usage accounting, shared quotas and conservative accounting where providers omit usage metadata. |
| Governance & Audit | Append-only audit ownership, activity review and support evidence. Current security evidence confirms the audit owner and encrypted K3s secrets. |
| Guardrails & Security | Inference guardrails, secret protection, digest-pinned running core images, privilege checks, certificate monitoring and compliance scans. |
| Platform Health | Host, Kubernetes, service, storage, backup, inference and dependency health with truthful degraded states. |
| GPU Monitoring | Prometheus/Grafana/DCGM operational view. The .155 control-plane node has no local GPU; telemetry can represent the associated accelerator provider. |
| System Console | Controlled administrative infrastructure access. |
Live architecture inventory
| Layer | Current components |
|---|---|
| Edge | Traefik ingress, canonical TLS host, role-aware Nexus portal |
| Identity | Keycloak OIDC and Nexus role enforcement |
| Application services | Portal, Core API, Admin Extension, App Gateway, Job Scheduler, Job Worker, Open WebUI, document scanner and renderer |
| Workspaces | JupyterHub, App Studio preview namespaces and application gateway |
| Durable data | PostgreSQL with pgvector, RabbitMQ and MinIO |
| Observability | Prometheus, Alertmanager, Grafana, Loki, Alloy, kube-state metrics, node/PostgreSQL/DCGM exporters |
| Orchestration | Single-node K3s with isolated namespaces, Services, ConfigMaps, Secrets, Jobs, Deployments and StatefulSets |
| Release and recovery | Signed offline bundles/packs, evidence timers, platform backups, restore verification and support bundles |
Demonstration and claim boundaries
.155is a development/Enterprise Pilot evidence environment, not a named production release or customer sizing benchmark.- The latest signed RC artifact and the live Kubernetes overlays are not a single immutable build. A clean source freeze and rebuilt signed media remain release work.
- Current evidence does not prove independent off-host disaster recovery, prior-release upgrade/rollback, customer PKI/AD integration, formal performance certification, or clean-machine Gate 11 installation.
- Provider connectors and external meeting services are provision-only until customer credentials, consent, retention and data-boundary decisions exist.
- Model quality, throughput and concurrency depend on the selected inference provider, model, quantization, context length and accelerator hardware.
- The document-scanner rollout requires reconciliation before claiming a fully healthy digitization service.
Recommended next actions
- Reconcile the document-scanner ReplicaSet and preserve a post-fix readiness record.
- Freeze live overlays into a reviewed source revision and rebuild signed release media.
- Complete Gate 10 acceptance and Gate 11 clean-machine/offline installation.
- Prove off-host backup and replacement-host restoration.
- Run prior-supported-release upgrade, migration and rollback qualification.
- Record model-specific performance and capacity baselines on each supported hardware tier.
- Complete customer PKI, directory federation and connector provisioning playbooks.