Graph-Forge

Graph-Forge understands polyglot code by modeling an entire codebase as a Neo4j knowledge graph augmented with Chroma vector embeddings — a dual index that answers both "what breaks if I refactor this?" (structure) and "find similar patterns" (semantics) in one platform.

It runs as ~19 polyglot microservices (Go + Python) communicating over gRPC internally and REST externally, behind a Go API gateway. Kafka-driven ingestion and Tree-sitter AST parsing feed the graph and embedding stores; PostgreSQL holds metadata and MinIO holds objects. Full OpenTelemetry → Jaeger / Prometheus / Loki / Grafana observability sits behind an Envoy L7 proxy, with a Next.js 3D graph explorer on top.

• ~19 microservices, gRPC internal / REST external
• Dual index: Neo4j (structure) + Chroma (semantics)
• Tree-sitter polyglot parsing · Kafka ingestion · RAG over large repos
• Full observability stack + Kubernetes substrate

The portfolio's strongest distributed-systems credential. 612 commits.

Architecture

Of the ~19 service directories in the repo, fifteen are real, implemented services split across two languages: nine in Go (gateway, auth, graph, knowledge-graph, repository, multi-repo-engine, patch-generator, git-provider, architecture-engine) and six in Python (ai-rag, indexing, agent-swarm, agent-runtime, ai-learning, plugin-runtime). The rest are placeholders that don't count toward that total: vector, search-aggregator, and webhook each contain only a go.mod/go.sum with zero source files, and ai is code folded into ai-rag's own Docker build rather than a standalone service. A separate workers/ tier — ingestion-worker, migration-runner, patch-validator, cross-repo-analyzer — runs alongside the real fifteen but outside the count.

The Go side is a genuine multi-module workspace, not a monolith wearing a go.work badge: the workspace file lists all 17 Go modules under Go 1.26.1, and there is deliberately no root go.mod. Every service owns its own module, and container images build with GOWORK=off — each image resolves its own dependency graph instead of leaning on workspace-wide resolution, which matters once 9 services are shipping and deploying independently.

Zero-trust here isn't a slide. Istio enforces cluster-wide STRICT mTLS over Envoy sidecars on every pod-to-pod call, OPA Gatekeeper enforces Restricted Pod Security at the cluster level, and tenant isolation itself is handled a layer up: every Neo4j node carries organization_id/repo_id properties, Chroma collections are namespaced per org/repo, and the gateway's TenantInterceptor middleware fails closed — a request missing tenant context gets a 401 unless a dev-only ALLOW_ANON_TENANT flag is deliberately set.

How It Works

1. Ingest. Kafka-driven ingestion feeds Tree-sitter AST parsing across the polyglot codebase; the parsed structure lands in Neo4j as the knowledge graph, while indexing chunks and embeds the same code into Chroma.
2. Retrieve. ai-rag answers a query by fusing two retrieval legs with Reciprocal Rank Fusion (core/fusion.py): BM25 lexical search and Chroma vector search. An optional HyDE query-rewrite leg (core/query_transform.py) is off by default; a cross-encoder reranker (core/reranker.py) is on by default.
3. Route the model call. LLM calls go through a FallbackLLMProvider that tries Bedrock first and falls back to a local Ollama model, walking a chain from claude-opus-4-6 down to sonnet-4-6 and haiku-4-5 as needed.
4. Delegate to the swarm for anything that mutates code. agent-swarm is a separate, durable LangGraph orchestrator: a Redis checkpointer persists state per thread/mission so a run resumes exactly where it left off, a Planner node fans out parallel tasks via LangGraph's Send API, and an interrupt_before node gates any code-mutating task behind explicit human approval before it executes.