Need OIDC-scoped cross-harness memory gateway #8

New issue

Open

opened 2026-08-31 20:22:43 +02:00 by jad · 0 comments

jad commented

2026-08-31 20:22:43 +02:00

Owner

Problem

Personal memory should survive across LibreChat and OpenCode without making
either harness the source of truth.

Direction

Use Mem0 as a self-hosted memory engine behind a small OIDC-aware gateway.

The canonical ownership key is PocketID issuer + sub, never email or display
name. Mem0 remains private infrastructure; it is not the authentication
authority.

Initial clients

LibreChat: forward its OpenID subject, LibreChat user ID, and conversation ID
to the gateway through configured custom-endpoint headers.
OpenCode: use PocketID device authorization through a local MCP adapter.
Begin with explicit recall, remember, forget, and search tools.

Required boundaries

Validate PocketID tokens at the gateway.
Separate personal, project, agent, and media scopes.
Preserve provenance, auditability, review, correction, export, and deletion.
Do not mix personal-chat memory with subtitle translation memory.
Keep Mem0, vector storage, extraction, and embeddings self-hosted.
Do not persist personal data before ZFS custody, replication, retention, and
deletion behavior are proven.

Evaluation sequence

Pin and update LibreChat before enabling its native memory feature.
Evaluate native user-controlled key/value memory as a baseline.
Prototype an OIDC-scoped gateway with synthetic data.
Evaluate Mem0 recall, invalidation, deletion, metadata filtering, and
OpenCode MCP interaction.
Decide whether opt-in automatic recall belongs in an OpenCode plugin.

Non-goals

Replacing LibreChat.
Treating the Mem0 API key as user identity.
Sharing personal memory with media translation workflows.
AMD Foundation For Telesense
Build the GPU substrate as an independent cluster capability first:

Finish Empirical’s final Ready, metrics, and reboot proof; close the outstanding fleet verification debt.
Deploy and pin the ROCm AMD device plugin only to Liberty and Empirical.
Prove a disposable GPU pod can see and use an allocated GPU.
Publish one private, OpenAI-compatible inference Service, with a stable in-cluster address such as http://inference.ai.svc.cluster.local/v1.
Keep Pulsar excluded because of its 88% image-filesystem warning.
Decide durable model-cache custody before calling the service stable: the cluster currently has no storage class, and model weights should not silently land on an arbitrary desktop root.
Add Telesense translation as a separate consumer of that API, with its own translation-memory/glossary store.

## Problem Personal memory should survive across LibreChat and OpenCode without making either harness the source of truth. ## Direction Use Mem0 as a self-hosted memory engine behind a small OIDC-aware gateway. The canonical ownership key is PocketID `issuer + sub`, never email or display name. Mem0 remains private infrastructure; it is not the authentication authority. ## Initial clients - LibreChat: forward its OpenID subject, LibreChat user ID, and conversation ID to the gateway through configured custom-endpoint headers. - OpenCode: use PocketID device authorization through a local MCP adapter. Begin with explicit `recall`, `remember`, `forget`, and `search` tools. ## Required boundaries - Validate PocketID tokens at the gateway. - Separate personal, project, agent, and media scopes. - Preserve provenance, auditability, review, correction, export, and deletion. - Do not mix personal-chat memory with subtitle translation memory. - Keep Mem0, vector storage, extraction, and embeddings self-hosted. - Do not persist personal data before ZFS custody, replication, retention, and deletion behavior are proven. ## Evaluation sequence 1. Pin and update LibreChat before enabling its native memory feature. 2. Evaluate native user-controlled key/value memory as a baseline. 3. Prototype an OIDC-scoped gateway with synthetic data. 4. Evaluate Mem0 recall, invalidation, deletion, metadata filtering, and OpenCode MCP interaction. 5. Decide whether opt-in automatic recall belongs in an OpenCode plugin. ## Non-goals - Replacing LibreChat. - Treating the Mem0 API key as user identity. - Sharing personal memory with media translation workflows. AMD Foundation For Telesense Build the GPU substrate as an independent cluster capability first: 1. Finish Empirical’s final Ready, metrics, and reboot proof; close the outstanding fleet verification debt. 2. Deploy and pin the ROCm AMD device plugin only to Liberty and Empirical. 3. Prove a disposable GPU pod can see and use an allocated GPU. 4. Publish one private, OpenAI-compatible inference Service, with a stable in-cluster address such as http://inference.ai.svc.cluster.local/v1. 5. Keep Pulsar excluded because of its 88% image-filesystem warning. 6. Decide durable model-cache custody before calling the service stable: the cluster currently has no storage class, and model weights should not silently land on an arbitrary desktop root. 7. Add Telesense translation as a separate consumer of that API, with its own translation-memory/glossary store.

jad added the

feat

work

explore

labels

2026-08-31 20:22:43 +02:00

jad added this to the Borealis Operations project

2026-08-31 20:22:48 +02:00