Platform Capability Matrix¶

Tracks each platform requirement against what is deployed and verified in the air-gap cluster (mod-auh1-dev-ask). Updated as E2E stages are completed.

Legend: ✅ Verified in cluster · 🟡 Deployed, not yet E2E tested · 🔲 Not yet deployed · ❓ Unknown

Summary¶

#	Requirement	Status	E2E Stage	Last Verified
1	Identity, SSO, RBAC	✅ Verified	Stage 4	2026-06-23
2	Department-scoped KB access	🟡 Ready to configure	Stage 5	—
3	File upload (PDF / DOCX / CSV / XLSX)	✅ Verified	Stage 5	2026-06-23
4	RAG / KB ingestion	✅ Verified E2E	Stage 5	2026-06-23
5	OCR / scanned PDF processing	🟡 VLM configured	Stage 5	—
6	Arabic / English support	🟡 Models support it	Stage 6	—
7	Citations / linked references	🟡 KMS returns metadata	Stage 5–6	—
8	Memo / summary / document generation	❌ Tool not deployed	Stage 6	2026-06-23
9	A3 / infographic output	❌ Tool not deployed	Stage 6	2026-06-23

1 — Identity, SSO, RBAC¶

Original assessment: Ready · 2 weeks · AD/LDAP/SAML available; departments mapped to groups/roles

Component	What is deployed	Status
IAM	Zitadel v4.5.0 (vendored in core-service chart)	✅ Running
SSO	Zitadel login at `https://sso.ask.mod.auh1.dev.dir`	✅ Running
RBAC	core-service org/user/role model (ask71_admin, superadmin)	✅ Verified
SAML / LDAP	Zitadel supports both — not yet configured	🔲 Pending AD/LDAP details

Verified (Stage 4, 2026-06-23):

Zitadel login 200 + sessionToken issued
core-service /api/v1/auth/login → 200
Role-based endpoint gating: testadmin (ask71_admin) → 403 on model-admin endpoints ✅
Superadmin login → full access ✅

Remaining: Configure Zitadel SAML/LDAP connector for MoD AD. Map AD department OUs to Zitadel groups → core-service roles.

2 — Department-scoped KB access¶

Original assessment: Mostly ready · 1 week · Groups and collection permissions; no separate "department" entity needed

Component	What is deployed	Status
KMS collections	Collections with actor-based access control	✅ Running
KMS org onboarding	`POST /organizations/onboard` verified	✅ Verified (2026-06-23)
Department → group mapping	Not yet configured	🔲 Needs org setup

How it works: Each department gets a KMS collection. Collection actors (/collections/{id}/actors) are set to the department's Zitadel group. Users outside the group get 403 on collection reads.

Remaining: Create per-department collections and map actors to groups after AD/Zitadel integration.

3 — File Upload (PDF / DOCX / CSV / XLSX)¶

Original assessment: Ready · Existing upload supports common document types

Component	What is deployed	Status
Upload endpoint	`POST /documents/upload/initiate` → presigned S3 → Ceph RGW	✅ API verified
S3 storage	Ceph RGW bucket `ask-knowledge-management`	✅ Running
Supported formats	`GET /documents/file_formats`	✅ Verified 2026-06-23

Verified formats (2026-06-23):

{"allowed_extensions":["pptx","docx","doc","pdf","txt","md","markdown","xml","csv","tsv","xls","xlsm","xlsx","jpg","jpeg","png","json","html","htm"]}

All MoD-required formats confirmed: PDF ✅ · DOCX/DOC ✅ · CSV/TSV ✅ · XLS/XLSX/XLSM ✅ · PPTX ✅ · Images (JPG/PNG) ✅

Remaining: Complete Stage 5 E2E ingest with a real MoD document.

4 — RAG / KB Ingestion¶

Original assessment: Ready · Validate against MoD documents and permission model

Component	What is deployed	Status
Hatchet ingestion worker	Running	✅
Embedding model	`qwen/qwen3-embedding-0-6b` (1024-dim, via Foundry)	✅ Onboarded
Vector store	Weaviate 1.34.0	✅ Running
Chunking	`hierarchical` (org default)	✅ Configured
Full ingest E2E	Verified 2026-06-23	✅

Verified (Stage 5, 2026-06-23):

Full pipeline confirmed with mod-test.txt:

POST /collections/          → collection_id f9d58607-...
POST /documents/upload/initiate  → document_id 5a5f5d97-... + presigned_url
PUT <presigned_url>         → 200 (stored in Ceph S3 bucket ask-knowledge-management)
PATCH update-status?upload_status=queued → 200, status=queued
[Hatchet] workflow_run_id=8a86346e, processing → ready (< 10s)
POST /retrieve/?query=...   → 200, documents[0].chunks[1] returned with content ✅

Retrieve response structure (note: not chunks[] at top level):

{
  "documents": [
    {
      "document_id": "...",
      "document_name": "mod-test.txt",
      "chunks": [{"id":"...","order":0,"content":"..."}]
    }
  ],
  "additional_info": {}
}

Remaining: Run with a real MoD PDF (Arabic + English, scanned). Validate chunk quality.

5 — OCR / Scanned PDF Processing¶

Original assessment: Mostly ready · 2–3 weeks · Depends on approved on-prem VLM/OCR strategy and scan quality

Component	What is deployed	Status
VLM model	`qwen/qwen3-5-122b-a10b-kms` (KMS-dedicated vision model)	✅ Configured
Parsing strategy	`generic` (org default — handles text + visual docs)	✅ Set
Scanned PDF test	Not yet run	🟡 Pending

How it works: KMS ingestion worker sends each page through the VLM for text extraction when the document parser detects non-selectable text (scanned content). The extracted text is then chunked and embedded.

Remaining: Upload a scanned PDF through Stage 5 ingest flow and inspect the resulting chunks in Weaviate. Compare extracted text quality against a native-text PDF.

6 — Arabic / English Support¶

Original assessment: Ready · Requires validation on MoD terminology and output quality

Component	What is deployed	Status
LLM	`qwen/qwen3-5-122b-a10b` — multilingual, strong Arabic	✅ Running
Embedding	`qwen/qwen3-embedding-0-6b` — multilingual	✅ Running
Arabic chat test	Not yet run	🟡 Stage 6
Arabic KB retrieval	Not yet run	🟡 Stage 5

Verify (Stage 6):

# Arabic chat smoke test
kubectl exec -i -n ask deploy/assistant-service-intelligence -- env KEY="$KEY" python3 - <<'EOF'
import os, httpx
r=httpx.post("http://foundry-litellm.foundry.svc.cluster.local:4000/v1/chat/completions",
  headers={"Authorization":"Bearer "+os.environ["KEY"]},
  json={"model":"qwen/qwen3-5-122b-a10b",
        "messages":[{"role":"user","content":"أجب باللغة العربية: ما هو الذكاء الاصطناعي؟"}],
        "max_tokens":100},timeout=60)
print(r.status_code, r.json().get("choices",[{}])[0].get("message",{}).get("content",""))
EOF

Remaining: Run Arabic chat + Arabic document ingest + Arabic query retrieve. Validate on MoD-domain terminology.

7 — Citations / Linked References¶

Original assessment: Ready · 0.5–1 week · Source documents must be ingested with stable metadata

Component	What is deployed	Status
KMS `/retrieve/`	Returns chunks with `document_id`, `collection_id`, metadata	✅ API verified
assistant-service citation wiring	Not yet tested E2E	🟡 Stage 6
Frontend citation UI	Not yet deployed (image rebuild pending)	🔲 Blocked on frontend

Remaining: After Stage 5 ingest, run /retrieve/ and inspect returned chunk metadata. Then run Stage 6 chat with a KB-enabled assistant and verify citations appear in the response.

8 — Memo / Summary / Document Generation¶

Original assessment: Partial · 2–3 weeks · DOCX tooling exists; MoD must provide official templates

Component	What is deployed	Status
assistant-service tool catalog	Checked 2026-06-23	✅
DOCX generation tool	`{"connectors":[],"total_count":0}` — not present	❌
MoD official templates	Not provided	🔲 Pending MoD

Verified (2026-06-23): Tool catalog is empty — GET /catalog/my-tools returns {"connectors":[],"total_count":0}. No DOCX, memo, or summary generation tool is deployed.

Remaining: - assistant-service-tooling connectors need to be deployed/configured - Confirm whether DOCX tool exists in the upstream chart (check mod-ask-assistant-service chart for tooling connectors) - Obtain MoD official templates before building

9 — A3 / Infographic Output¶

Original assessment: Partial · 3–5 weeks · Needs sample layouts; likely template-based first release

Component	What is deployed	Status
Infographic / layout tool	Tool catalog empty	❌
Tool catalog check	Done 2026-06-23	✅

Verified (2026-06-23): Tool catalog empty — no infographic, A3, or layout tool deployed. This is custom development work.

Remaining: Design approach — likely LLM + template rendering (HTML→PDF or DOCX). Requires MoD sample A3 layouts before scoping.

E2E Test Coverage Map¶

Stage	Tests	Capabilities covered
Stage 1	All Foundry models respond	Underpins 4, 5, 6, 7, 8
Stage 2	KMS health, Weaviate ready	Underpins 4, 5, 7
Stage 3	assistant-service health, tool catalog	8, 9
Stage 4	Login, RBAC, model catalog	1 ✅, 2
Stage 5	Ingest → retrieve → rerank	3, 4, 5, 7
Stage 6	Chat, Arabic, citations, DOCX	6, 7, 8, 9

Open Actions¶

Action	Owner	Blocks
Check `/documents/file_formats`	E2E run	#3
Complete Stage 5 ingest E2E	E2E run	#4, #5, #7
Run Arabic chat + retrieve	E2E run	#6
Check `/catalog/my-tools` for DOCX / infographic	E2E run	#8, #9
Configure Zitadel SAML/LDAP for MoD AD	MoD + platform team	#1, #2
Create per-department KMS collections	Platform team	#2
Obtain MoD official document templates	MoD	#8, #9