Capability

Implementation

Ingestion

Fixed, sentence and recursive chunking with token overlap and exact character offsets; SHA-256 digests per document and chunk; document versions with effective_at / expires_at

Content controls

Prompt-injection screening per chunk with trust-dependent thresholds (quarantined chunks are never retrievable); credentials redacted before storage or embedding

Hybrid retrieval

Okapi BM25 + dense vectors fused with reciprocal rank fusion; cross-encoder reranking (lexical or hosted /rerank); MMR diversification; metadata, document, classification and as_of filters

Vector backends

In-process exact cosine search rebuilt from PostgreSQL, or pgvector HNSW (GRAPHRAG_VECTOR_BACKEND=pgvector)

Knowledge graph

Pattern or model-grounded entity and relation extraction; entity resolution (blocking, Jaro-Winkler, acronyms, union-find); assertions with valid_from / valid_to

GraphRAG

Hierarchical Louvain communities with extractive or model summaries; local search (personalised PageRank) and global search over community summaries

Context engineering

Query-focused compression, near-duplicate removal, section budgets for passages, graph facts and community summaries; every source keeps provenance; spotlighted rendering

Agentic workflow

Planner (passages, local, global), iterative retrieval with query expansion, attributed generation, groundedness evaluation, policy-gated release (answered, abstained, withheld, pending approval)

Evaluation

Groundedness per claim (supported / partial / contradicted / unsupported), citation precision and coverage; retrieval recall, precision, MRR and nDCG against golden sets

Identity and authorization

Every call authorized by agent-identity-fabric /v1/authorize, or by local JWT verification plus policy; never allow-all

Agent protocols

MCP server (official SDK, streamable HTTP) with six typed tools; A2A Agent Card and JSON-RPC message/send

Audit and observability

Hash-chained Ed25519-signed audit events; Prometheus metrics, OpenTelemetry traces, JSON logs with correlation IDs, SLO alerts, Grafana dashboard

Endpoint

Scope

Purpose

POST /v1/collections

rag:collection.create

Create a collection with a classification and owner

GET /v1/collections, GET /v1/collections/{collection}

rag:collection.read

Inventory

POST /v1/collections/{collection}/documents

rag:document.write

Ingest a document version

GET /v1/collections/{collection}/documents, GET .../documents/{document_id}

rag:document.read

Documents and their chunks with offsets and digests

DELETE /v1/collections/{collection}/documents/{document_id}

rag:document.delete

Right-to-erasure cascade

POST /v1/collections/{collection}/search

rag:search

Hybrid retrieval with score breakdown

POST /v1/collections/{collection}/context

rag:context

Budgeted, attributed context pack for the caller's own model

POST /v1/collections/{collection}/query

rag:query

Agentic RAG answer with citations, groundedness and release decision

POST /v1/collections/{collection}/graph/build

rag:graph.build

Entity resolution, communities and summaries

GET /v1/collections/{collection}/entities

rag:graph.read

Entity lookup by name or alias

GET /v1/collections/{collection}/entities/{entity_id}/neighbourhood

rag:graph.read

k-hop neighbourhood, optionally as_of a past instant

GET /v1/collections/{collection}/communities

rag:graph.read

Community summaries by level

POST /v1/evaluations/groundedness

rag:evaluate

Judge an attributed answer against its sources

POST /v1/collections/{collection}/evaluations/retrieval

rag:evaluate

Recall, precision, MRR, nDCG on a golden set

POST /mcp

per tool

MCP streamable HTTP endpoint

GET /.well-known/agent-card.json

none

A2A Agent Card

POST /a2a

rag:query / rag:context

A2A JSON-RPC message/send

GET /healthz, /readyz, /metrics

none

Operations

Tool

Purpose

search_passages

Hybrid retrieval over one collection

build_context

Planned, budgeted, attributed context pack

answer_question

Grounded answer with citations, groundedness report and release decision

explore_entity

Find an entity by name and return its graph neighbourhood

evaluate_groundedness

Per-claim groundedness of an attributed answer

ingest_document

Chunk, screen, embed and graph-extract a document version

Layer

Location

Container image

Dockerfile (non-root uid 10001, read-only root filesystem compatible)

Helm chart

deployments/helm/context-engineering-graphrag (StatefulSet with per-replica audit volume, PDB, HPA, NetworkPolicy, ServiceMonitor)

Namespace and secret sync

deployments/kubernetes (restricted Pod Security, default-deny, External Secrets)

Cloud infrastructure

deployments/terraform/{aws,azure,gcp}: managed PostgreSQL with pgvector, KMS, secret store, WORM audit storage, workload identity, model access