Repository navigation
Knowledge Intelligence 3.0: enterprise RAG platform - #23
Merged
Merged
Conversation
Transform the single-user CSV-AI Streamlit app into Knowledge Intelligence, a multi-tenant, permission-aware RAG and knowledge platform. CSV-AI's data loading, profiling and provider abstraction are kept (moved under backend/app). - FastAPI backend on PostgreSQL 16 + pgvector: forced row-level security on every tenant table, RBAC (custom roles, resource grants, deny rules, expiry), enforced org security policy (required MFA, session lifetime), append-only audit log, encrypted credentials, SSRF guard - Ingestion of 30+ formats with locators; hybrid dense/BM25 retrieval, reranking, grounded answers with verified citations and refusals - Text-to-SQL with validation, sandboxing and approvals (withdrawable, expiring); database connectors with incremental sync - Integrations: website, sitemap, RSS, GitHub, S3, GitLab, plus OAuth/token connectors for Google Drive, OneDrive, SharePoint, Dropbox, Notion, Confluence, Slack, Teams and IMAP (beta until vendor apps are configured) - Agents whose tools inherit the user's permissions; approved tools resume the paused run in the background - LLM providers incl. Anthropic (API 2026-10-21) and OpenAI with live model discovery and a platform model fallback; live evaluation with Claude and GPT - Next.js 15 frontend with the Porcelain/Graphite design system, streaming chat with citations and the live Connections map - 200 backend tests, a Playwright end-to-end suite, CI with a pgvector service, Docker Compose deployment, and architecture, security, testing, evaluation and implementation-status docs Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
main held the original CSV-AI Streamlit app (v1). This merge makes the Knowledge Intelligence platform the content of main while keeping both histories: the v1 commits (first parent) and the v2 -> 3.0 line (second parent), so main fast-forwards from its previous state. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 39399587 | Triggered | Generic Password | 8022182 | .github/workflows/ci.yml | View secret |
| 39399587 | Triggered | Generic Password | 8022182 | .github/workflows/ci.yml | View secret |
| 39399586 | Triggered | Username Password | 4933f00 | backend/app/connectors/integrations.py | View secret |
| 39399587 | Triggered | Generic Password | 4933f00 | .github/workflows/ci.yml | View secret |
| 39399587 | Triggered | Generic Password | 4933f00 | .github/workflows/ci.yml | View secret |
| 39399586 | Triggered | Username Password | 8022182 | backend/app/connectors/integrations.py | View secret |
| 39399587 | Triggered | Generic Password | 4933f00 | .github/workflows/ci.yml | View secret |
| 39399587 | Triggered | Generic Password | 8022182 | .github/workflows/ci.yml | View secret |
| 39399587 | Triggered | Generic Password | 8022182 | .github/workflows/ci.yml | View secret |
| 39399587 | Triggered | Generic Password | 4933f00 | .github/workflows/ci.yml | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
- backend/pyproject.toml pointed readme at ../README.md, outside the package; current setuptools refuses that, so `pip install -e` failed in the backend and e2e jobs. Add backend/README.md and point at it. - Run the disposable CI Postgres containers with trust authentication so no passwords appear in ci.yml (flagged by GitGuardian). - Reword the IMAP catalog label that tripped a username/password detector. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The connector tests reached the "customer" database on the same server and port as the platform database, which the SSRF guard deliberately refuses (6 backend failures). Give the customer database its own Postgres service on port 5433, as the embedded setup does locally with a second server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Turns the CSV-AI Streamlit app into Knowledge Intelligence, a multi-tenant, permission-aware enterprise RAG platform (FastAPI + PostgreSQL/pgvector backend, Next.js frontend).
What's in it
DEPLOYMENT.md.2026-10-21), OpenAI and others, with live model discovery and an optional platform default model.History
mainheld the original 2024 app, which shares no history with the newerv2line this work is built on. The head commit is a merge whose parents are the oldmainand the new work, so both histories are kept and nothing is force-pushed. Its contents are exactly the new platform.Verification
tscandnext buildpass (27 routes).frontend/e2e, 11 scenarios incl. mobile) passes locally.docs/RAG_EVALUATION.md.What's done, beta and planned is listed in
IMPLEMENTATION_STATUS.md.🤖 Generated with Claude Code