Security first
JWT authentication, role-based access, workspace authorization, prompt-injection detection, and PII redaction primitives.
System topology
Reference implementation boundaries
The application is intentionally split into independently replaceable surfaces so teams can promote the local demo to managed cloud services without rewriting business logic.
Users & reviewers
↓
Web console
REST / SSE API
Admin workflows
↓
Auth + RBAC
Workspace isolation
Guardrails
Observability
↓
Ingestion
Retrieval
Generation
Evaluation
↓
PostgreSQL
Redis
Qdrant
MinIO
Prometheus
Lifecycle
From enterprise content to cited answers
The demo follows a production RAG path with explicit data ownership, retrieval diagnostics, confidence scoring, and human review routing for low-confidence answers.
- IngestRegister sources, normalize text, chunk documents, and persist metadata.
- IndexCreate embeddings through provider seams and store workspace-scoped vectors.
- RetrieveRun similarity, hybrid, and MMR-style retrieval with explainable diagnostics.
- GenerateProduce structured answers with citations, confidence, and safe fallback behavior.
- OperateTrack health, metrics, evaluations, and roadmap items for production hardening.
Production concerns
Built around enterprise operating requirements
Cloud portable
Docker Compose for the local stack with package boundaries that map cleanly to AWS, Azure, GCP, or managed SaaS services.
Observable
Health endpoints, structured logging seams, Prometheus metrics, and evaluation scripts provide operational visibility.
Provider neutral
LLM, embedding, vector store, object storage, and model provider interfaces isolate vendor-specific code.
Explore the repo