Services
Live and planned IBEX Harness services — proxy, auth, memory, context, and workers.
IBEX Harness follows microservice boundaries with a clear split: Go services own the latency-critical proxy and auth paths; Python services will own memory, context assembly, and async workers. Only the Go services ship today.
Live services
LLM Proxy
StableLanguage: Go · Port: 8080
The proxy is the public HTTP edge. Protected chat routes run middleware in fixed order: body limit → Content-Type → auth → agent verify → rate limit → directive resolve → chat parse → provider routing → handler.
| Responsibility | Status |
|---|---|
ValidateToken via auth gRPC (+ optional auth cache) | Live |
Agent identity (X-IBEX-Agent-ID) | Live |
| Per-org rate limits (Redis) | Live |
| OpenAI-compatible body normalization | Live |
| Mock / live provider forwarding | Live |
| Directives + sessions + idempotency | Live (when Postgres/Redis configured) |
| Async ClickHouse traces | Live when CLICKHOUSE_DSN set |
| Memory injection | Not wired (Phase 3) |
See Proxy overview for middleware detail and probe commands.
Auth Service
StableLanguage: Go · HTTP: 8081 · gRPC: 9091
Central identity store. Issues PATs (Argon2id-hashed), validates tokens and agents for the proxy, publishes revocations to Redis, and enforces Postgres RLS on ibex_core tables.
| gRPC RPC | Purpose |
|---|---|
ValidateToken | Resolve org_id, permissions, token_id from bearer PAT |
ValidateAgent | Confirm agent belongs to org |
CreateToken / RevokeToken / ListTokens | PAT lifecycle |
See Auth overview and ADR-0011.
Proxy
GuideMiddleware chain, rate limits, and routing.
Learn more →LiveAuth
GuidePAT issuance, gRPC validation, and RLS.
Learn more →Proxy auth client
ReferenceADR for gRPC client and fail-closed behavior.
Learn more →Planned services
These services are specified in engineering docs and will appear in compose as their milestones land. Do not assume they are reachable today.
Memory Service
BetaLanguage: Python (FastAPI) · Phase: 3
Write, deduplicate, and retrieve agent memories. Semantic search via pgvector, PII redaction, conflict detection triggers, and hot-cache writes to Redis.
Context Assembly Engine
BetaLanguage: Python (gRPC) · Phase: 3
Assembles directive + memories + conversation history within the model token budget. Parallel retrieval with a bounded deadline; greedy knapsack packing by composite relevance score.
Embedding Service
BetaLanguage: Python (FastAPI) · Phase: 3
Batch embedding via all-MiniLM-L6-v2 (384 dimensions). Buffers requests (64 items or 50ms) for GPU throughput.
Background Workers
BetaLanguage: Python (Celery) · Phase: 3
Async pipelines: memory extraction after each inference, conflict resolution, behavioral fingerprinting, drift detection, notifications, and garbage collection.
API Server & Dashboard
BetaLanguages: Python (FastAPI) + Next.js · Phase: 3–4
Management REST API and operator dashboard for agents, directives, memories, and drift alerts.
Data model
ReferenceOrgs, agents, tokens, sessions, and future memory tables.
Learn more →Request lifecycle
GuideEnd-to-end proxy flow with sequence diagram.
Learn more →Glossary
ReferenceService names, acronyms, and domain terms.
Learn more →Shared Go packages
Cross-cutting infrastructure lives in packages/* and is imported by proxy and auth:
| Package | Role |
|---|---|
logger | Structured JSON logging (mandatory in services) |
reqid | UUID v7 request ID propagation |
ratelimit | Redis sliding-window limiter interface |
authcache / revocation | Bloom+LRU cache and revoke pub/sub |
directive / injection / session / idempotency | Late Phase 2 critical-path features |
provider / provider/openai / provider/mockllm | Provider registry and adapters |
clickhouse | Async llm_traces writer |
permissions | 64-bit permission bitmap (ADR-0009) |
apierror | Canonical error codes |
metrics / telemetry | Prometheus and OpenTelemetry |
Infrastructure dependencies
| Store | Used by | Status |
|---|---|---|
| PostgreSQL 16 | Auth (identity); proxy (directives/sessions) | Live |
| Redis 7 | Proxy (rate limits, cache, idempotency); auth (revoke publish) | Live |
| ClickHouse | Proxy (async traces) | Live when DSN set |
| MinIO | Session archives | Planned (Phase 3+) |
Was this page helpful?
Last updated on