"Should I attempt this?" + "Did I represent the context faithfully?"
Competence Gate
Pre-synthesis check: does the knowledge graph have enough coverage for this query?
Prevents attempts on queries outside the system's knowledge.
Verification Gate
Post-synthesis check: does the response faithfully represent the retrieved context? Two LLM-free verifiers run in production (rule-based grounding + Belnap four-valued); perturbation attribution is a future higher-precision path.
Catches hallucinations and unfaithful responses.
Rule-Based Grounding Gate
Production verifier (verify_response_rule_based): extracts implied triples from the response and checks word-overlap against context triples; passes iff faithfulness ≥ 0.5.
The default verifier on every chat response — no LLM.
Belnap Four-Valued Gate
Production verifier (verify_with_belnap, qadra-belnap crate): grounds each claim against a polarity-tagged SPO graph over Belnap logic — Grounded / Contradicted / Contested / Ungrounded. Fails only on Contradicted.
Distinguishes "false" from "no evidence"; pure-Rust, optional ONNX UD parser.
Perturbation Analysis
Systematically removing triples to measure their impact on responses (verify_response). Higher-precision attribution path, not yet on the live chat pipeline.
Reveals which facts actually influenced the output.
Fidelity
How well perturbation responses align with the original (R-squared).
High fidelity = attributions explain the variance.
Faithfulness
Correlation between attributions and actual response impact.
High faithfulness = attributions are trustworthy.
Stability
Robustness of responses to knowledge graph modifications.
High stability = responses do not flip on minor changes.
The truth layer. Stateless Rust application handling all NATS subjects. Owns PostgreSQL and MongoDB connections. Eight handler groups: epistemic, workload, auth, email, audit, observer, admin, flow.
Source of truth for all data operations. Never accessed directly via HTTP.
Gateway
Node.js HTTP service (gateway/) that handles JWT creation/validation, CORS, file uploads to MinIO, and routes HTTP requests to Rust Core via NATS. Never touches PostgreSQL directly.
Thin HTTP surface translating REST into NATS request-reply.
Python Agent
Python service (agent/) that handles LLM-driven orchestration. Receives NATS messages for workload execution, agent queries, and document verification.
The intelligence layer---Rust handles data, Python handles reasoning.
NATS
Message bus for all inter-service communication. Request-reply pattern. JetStream enabled for durable streams.
Decouples services. Core, Agent, and Gateway communicate only through NATS.
NATS Observer
Catch-all NATS subscriber (qadra.>) that records every message to MongoDB nats_audit collection. Metadata only, no payload content. Fire-and-forget.
Full audit trail without modifying existing handlers. Skips qadra.audit.> to avoid recursion.
ServiceContainer
IoC container wiring all trait implementations. Built via ServiceContainer::from_config(config).
Single point of configuration. Easy testing with mocks. Swap backends without code changes.
Hot Layer
Redis cache/streams for frequently accessed data.
10-100x faster than PostgreSQL for repeated reads.
Source of Truth
PostgreSQL. All authoritative state lives here.
If Redis says X and PostgreSQL says Y, PostgreSQL wins.
Junction record linking a user to a tenant with a per-tenant role and is_default flag.
Users can belong to multiple organizations.
Super Admin
Platform-level is_super_admin boolean on users table. NOT a per-tenant role. Capabilities: create tenants, drop into any tenant, reset passwords, promote/demote.
Server-wide privilege for platform operators. First super admin promoted via direct SQL.
Admin Drop-In
Super admin switching into a tenant they do not belong to. Creates a synthetic JWT with target tenant context. Does NOT add to user_tenants.
Platform support without polluting tenant member lists.