What you can build with Moʻolelo today.

GitHub, Confluence, SharePoint and Microsoft Graph today, with a connector framework designed to be extended without forking. Each connector runs in one of four modes (poll, webhook, hybrid, snapshot) chosen per source — never both poll and webhook as primaries simultaneously.

• OAuth 2.0 with refresh-token caching and per-tenant credential isolation
• Webhook ingress validates upstream signatures (HMAC, Microsoft Graph clientState)
• Cursors persisted to Postgres so restarts never re-ingest or skip records
• "Disabled if not configured" — silent sources stay silent until provisioned

A canonical-person resolver merges identities across IdPs (Atlassian, Microsoft Entra, GitHub) under a single ID. ACLs from each source are projected into a per-tenant OpenFGA store, then enforced at query time — coordinator-side filtering plus an in-Vespa Searcher plugin for ReBAC-shaped permissions.

• Per-tenant OpenFGA store with hybrid relations + conditional tuples
• ReBAC-aware retrieval via the Apache 2.0 Vespa OpenFGA Searcher plugin
• Reconciliation handles missed webhooks; weekly full re-snapshot by default
• Authority chain populated on every served result — visible in audit

PII tokenizes into per-subject regional vaults. The global graph carries opaque tokens. Queries federate across regions; the data itself never does. Single-region deployments use a degenerate mode that keeps the same interface; multi-region adds vault-mediated federation without changing application code.

• AES-GCM for opaque fields, format-preserving encryption for joinable fields
• Inline PII detection via Presidio at ingest — every chunk carries an audit trail of detected spans; the per-span tokenizer routes them to each subject's home-region vault when the vault is wired
• GDPR Article 17 subject-erasure admin endpoint — invalidates every token belonging to a subject across all regional vaults; the erasure event itself is retained in the audit log so the regulator trail outlives the data
• Detokenize requires a SPIFFE-attested workload identity and per-field policy check
• Audit row records the tokenization scheme on every query — operators can prove no silent fallback to cleartext
• Vault-disabled mode is a first-class deployment shape (passthrough binding)

A supersession engine watches the corpus for documents replaced by fresher, more authoritative ones, and demotes the stale versions at retrieval time. The "what supersedes what" decision follows an operator-defined per-tenant authority hierarchy — merged PRs over drafts, canonical pages over comments, source-of-truth over snapshots — so the algorithm follows your governance rules instead of guessing.

• Five signal layers: byte-equal duplicates, MinHash near-duplicates via Apache DataSketches, semantic near-duplicates via the embedding index, transitive supersedes-graph traversal, and explicit CDC events from connectors ("PR #42 merged, closes #7")
• Per-tenant authority matrix maps (source, record_type) → priority; ties intentionally keep both chunks so the engine never silently picks the wrong winner
• Three retrieval policies per tenant — filter superseded chunks out, re-rank them down, or surface them with a "replaced by" marker (the default, which operators in regulated industries pick for the audit trail)
• Streaming + nightly reconciliation: a stale doc gets demoted within seconds of its replacement arriving; the nightly batch pass catches anything ordering-dependent the streaming path missed

Vespa hybrid retrieval (BM25 + dense embeddings via bge-m3). Coordinator orchestrates ACL filtering, one-hop graph expansion through the NebulaGraph knowledge layer, supersession-aware ranking, detokenization, and result assembly. MCP server exposes a single `search` tool for LLM agents; gRPC for direct integrations. Search is one surface — the graph and the supersession engine are queryable independently.

• Knowledge-graph expansion via NebulaGraph: each served hit can carry a "see also" set of related entities (typed `refers_to` edges extracted from cross-document references — Jira keys, GitHub `owner/repo#N`, Confluence inter-page links, URLs to known sources), every one of them filtered through the same ACL check as the hit itself
• Supersession-aware: stale chunks come back with a `superseded_by` marker pointing at the canonical replacement (operator-configurable: drop, demote, or mark)
• Audit row per query: caller, latency, hits, authority chain, tokenizer mode
• MCP `search` tool integrates with Claude, ChatGPT, and any MCP-compatible client
• Iceberg query path via Trino, DuckDB, Spark, or PyIceberg for analytics
• Bring your own LLM — vLLM + KServe, no managed-service lock-in

Every container image, Helm chart, ML model, and Python wheel mirrors to your Harbor. License-key validation is offline-friendly with a 7-day grace window. The only network requirement is the licensing portal at registration and renewal — never in steady state.

• Helm + ArgoCD per service, with PDBs, NetworkPolicies, and SPIFFE annotations
• Linkerd service mesh; SPIRE for workload identity
• OpenTelemetry traces, Prometheus metrics, structured JSON logs
• Kubernetes-native — no proprietary control plane required

Moʻolelo ships under BSL v1.1 with an Additional Use Grant for in-house enterprise use. Every deployment needs a valid license key — Community keys are free, Commercial keys are paid. Each release reverts to Apache 2.0 four years after publication. The Vespa OpenFGA plugin is Apache 2.0 from day one.

• Read the source, run it, modify it for in-house use — the BSL grant covers all that
• Free Community license issued instantly through the website — covers single-tenant single-region production use at any organization
• Commercial license unlocks multi-tenant and multi-region; required for any deployment at an organization above $10M USD annual revenue
• License keys are self-issued through your account on this website; validation runs offline against an embedded ed25519 public key with a 7-day grace window — no SaaS dependency in steady state