[janosmurai]

Type of change

• New feature
• Documentation update

Related issue

SHD-1075

Description

Adds an explicitly selected local Compose overlay for the optional Knowledge Center. The server remains the public ingress and owns authentication/metadata; KC exclusively owns RustFS operations and storage credentials. Ordinary Compose behavior is unchanged when the overlay is absent.

Adds protected, exclusive credential-file setup and explicit account/model/readiness helpers. Authenticated operator requests reject redirects, and readiness enforces supported registered-model dimensions. Persistent server, object and vector state uses named volumes; the notification relay accepts only its fixed route.

Validation

• cargo +1.98.1 fmt --check
• cargo +1.98.1 clippy --offline --locked --all-targets --all-features -- -D warnings
• cargo +1.98.1 build --offline --locked --verbose --all-features
• cargo +1.98.1 test --offline --locked --verbose --all-features

Independent helper/config verification passed 27 tests, including actual local HTTP redirect rejection, dimension validation, exclusive file creation and optional/no-KC configuration. Independent source review passed after the scoped corrections.

The corrected independent named-volume runtime suite passed 87 assertions: public PDF/DOCX upload through KC, signed caller-scoped MCP citations, exact object/vector persistence across down/up, deletion with dependency readback, and preservation of an unrelated uploaded file. Cleanup and unchanged protected services were verified.

Runtime verification used compatible cached images with source-matched native binary mounts and an explicitly synthetic embedding double. It does not establish packaged-image startup, operator-provider compatibility, backup/restore or migration. Standard local gates passed on unchanged source; the ordinary parallel Rust suite passed 180 tests with one inherited transport diagnostic ignored.

Deployment and compatibility

Opt-in only; requires Docker Compose 2.24.4+, locally available compatible images, protected credentials and a registered embedding provider.

Documentation

Adds operator instructions for setup, explicit account/model registration, trust boundaries, liveness versus readiness, private image prerequisites and volume-preserving operation. Links the optional overlay from the main README.

Checklist

• I added or updated tests for changed behavior, or explained why tests are not needed.
• I updated user-facing and API documentation where necessary.
• My commits follow the Conventional Commits specification.
• Every commit includes a Signed-off-by trailer (git commit -s).

AI assistance:

• Tool: Codex and Hermes.
• Model: implementation, correction and independent review used gpt-6.1-sol through shaide.
• Used for: implementation, tests, independent review and integration verification.
• Human verification: done.