Sovereign server deployment

For regulated pilots, platform teams run a customer-hosted API server with OpenAI-compatible inference (typically vLLM), Chroma, Redis, and OIDC. This is not “Engine + Ollama on every laptop,” and it is not dual-plane multi-user (that programme is post-demo). Developers install the VS Code extension only and point it at your HTTPS endpoint.

Two deployment stories (do not conflate)

Path Who runs inference Typical stack When to use
Local-first (default) Each developer machine ContextMint Engine tray + Ollama Individual pilots, demos, air-gapped laptops
Sovereign server (pilot) Shared host in your DC / tenant API containers + vLLM (or other OpenAI-compat) + OIDC Bank / gov design partners needing one audit boundary

Trust overview: Trust & Security — deployment models. Operator dogfood and flip checklist: product repo documentation/GATE-SS-MVP-RUNBOOK.md.

What platform teams deploy

  • API server — Docker Compose (deploy/docker-compose.server.yml) or equivalent; profile deployment_profile=server
  • Inference — OpenAI-compatible endpoint (vLLM overlay common); set INFERENCE__OPENAI_COMPAT__BASE_URL
  • Vectors — Chroma on shared storage for MVP; Qdrant is a later scale option
  • Auth — AUTH__ENABLED=true, OIDC issuer/audience, strong JWT secret, workspace ACL as required
  • Path alignment — ALLOWED_WORKSPACE_ROOTS must match mounts or Remote SSH paths the server can read

Env template: deploy/profiles/server-sovereign.env.example. Path alignment guide: product repo documentation/SOVEREIGN-PATH-ALIGNMENT.md.

What developers do

  1. Install the ContextMint extension only (do not require Engine on every laptop).
  2. Set ContextMint.serverUrl to the team HTTPS API.
  3. Enable ContextMint.enterpriseMode and configure ContextMint.oidcProviderId.
  4. Open a workspace the server can index (Remote SSH or matching mount).

Health & readiness

  • GET /api/health — shows deployment_profile and inference_provider
  • GET /api/ready — fails closed when the inference provider is unreachable or the OIDC / auth checklist fails on server profile

Explicit non-goals (this page)

  • Not dual-plane multi-user (local WIP + sovereign main) — that is GATE-SS-MU after the mid-Sept demo
  • Not full ownership / CODEOWNERS product (Block RO) — branch review may show thin owner teaser labels only
  • Not Engine tray as the server control plane — operators use compose, logs, and health endpoints

Related