Sovereign server deployment

For regulated pilots, platform teams run a customer-hosted API server with OpenAI-compatible inference (typically vLLM), Chroma, Redis, and OIDC. This is not “Engine + Ollama on every laptop,” and it is not dual-plane multi-user (that programme is post-demo). Developers install the VS Code extension only and point it at your HTTPS endpoint.

Two deployment stories (do not conflate)

Path Who runs inference Typical stack When to use
Local-first (default) Each developer machine ContextMint Engine tray + Ollama Individual pilots, demos, air-gapped laptops
Sovereign server (pilot) Shared host in your DC / tenant API containers + vLLM (or other OpenAI-compat) + OIDC Bank / gov design partners needing one audit boundary

Trust overview: Trust & Security — deployment models. Operator dogfood and flip checklist: product repo documentation/GATE-SS-MVP-RUNBOOK.md.

What platform teams deploy

  • API server — Docker Compose (deploy/docker-compose.server.yml) or equivalent; profile deployment_profile=server
  • Inference — OpenAI-compatible endpoint (vLLM overlay common); set INFERENCE__OPENAI_COMPAT__BASE_URL
  • Vectors — Chroma on shared storage for MVP; Qdrant is a later scale option
  • Auth — AUTH__ENABLED=true, OIDC issuer/audience, strong JWT secret, workspace ACL as required
  • Path alignment — ALLOWED_WORKSPACE_ROOTS must match mounts or Remote SSH paths the server can read

Env template: deploy/profiles/server-sovereign.env.example. Path alignment guide: product repo documentation/SOVEREIGN-PATH-ALIGNMENT.md.

What developers do

  1. Install the ContextMint extension only (do not require Engine on every laptop).
  2. Set ContextMint.serverUrl to the team HTTPS API.
  3. Enable ContextMint.enterpriseMode and configure ContextMint.oidcProviderId.
  4. Open a workspace the server can index (Remote SSH or matching mount).

Health & readiness

  • GET /api/health — shows deployment_profile and inference_provider
  • GET /api/ready — fails closed when the inference provider is unreachable or the OIDC / auth checklist fails on server profile

Explicit non-goals (this page)

  • Not dual-plane multi-user (local WIP + sovereign main) — that is GATE-SS-MU after the mid-Sept demo (eng ready; defaults off; PO dogfood open)
  • Not full ownership / CODEOWNERS product (Block RO) — branch review may show thin owner teaser labels only; FOI claims stay gated
  • Not Engine tray as the server control plane — operators use compose, logs, health endpoints, and Engine → Server Config for YAML overlays
  • Not AG-INTEL tools (LSP/git/packs) on by default without overlay — enable via full-parity / ag-intel dogfood; agent/review/inline are Wave J1 default-on
  • Not GATE-W1 / shipped Memory Tab product / GATE-AHA / GATE-FEATURE-LITE product / GATE-W2 product / GATE-W3 product / GATE-W4 product / GATE-V2-CORE product / GATE-V3 / Feature Registry product / Decision Graph product / GATE-EVIDENCE product / GATE-IMPACT product / GATE-EXPLAIN product / GATE-DRIFT product / GATE-SCORECARD product — Fabric list/get + shadow + Memory Tab + thin learner/decay + thin audit/RBAC foundations + Memory Tab filter/audit UX + domain filter thin + graph neighborhood thin + convention links thin + convention query thin + parity harness slices 1–4 + F5/scale eng closeout + Block UA Repository DNA thin + Block UB Feature Registry Lite thin + Block V CHRONOS/Health/Architecture Tab thin + Block W ORACLE basic + chain stubs + Block X Recipe A VLM (U22 paste ARGUS already shipped) + Block Y MESH skipped (GATE-W5 N/A) + Block Z GATE-V2-CORE eng composite (dogfood v2-core) + Block AA+AB Feature Registry eng (dogfood feature-registry; promote/correct/wizard) + Block AC Decision Graph eng (dogfood decision-graph; Decision View; not GATE-EVIDENCE product) + Block AD Blast/Impact eng (dogfood blast-impact) + Block AE Drift eng (dogfood drift-baselines; not GATE-DRIFT product) + Block AF Command Center + Scorecards eng (dogfood command-center; not GATE-SCORECARD product; not v3.0.0-mvp product tag; Impact sidebar; not GATE-IMPACT / not GATE-EXPLAIN product) exist behind fabric.* / chronos.* / oracle.* / chains.* / scorecards.* flags (defaults off for new Wave flags; wave eng ready; PO soak open; not GATE-W1 product; not GATE-AHA; not GATE-FEATURE-LITE product; not GATE-W2 product; not GATE-W3 product; not GATE-W4 product; not GATE-V2-CORE product; not GATE-V3; not Feature Registry product; not Decision Graph product; not GATE-EVIDENCE product; not GATE-IMPACT product; not GATE-EXPLAIN product; not GATE-DRIFT product; not GATE-SCORECARD product; not graph ORACLE; not MESH; ARGUS report-only); read_cutover stays false

Where settings live

  • Server — config/contextmint.defaults.yaml (+ ~/.contextmint/server.defaults.yaml overlay). Browse grouped keys in Engine → Server Config or site Settings docs.
  • VS Code extension — contextmint.* in VS Code Settings (ui.defaults.json). Points at ContextMint.serverUrl; does not replace server agent/review toggles.
  • Desktop Engine — lifecycle (supervisor) + Server Config catalog mirrored from the same YAML defaults.

Full catalogs: Settings reference.

Related