Graph-Forge

Graph-Forge understands polyglot code by modeling an entire codebase as a Neo4j knowledge graph augmented with Chroma vector embeddings — a dual index that answers both "what breaks if I refactor this?" (structure) and "find similar patterns" (semantics) in one platform.

It runs as 19 polyglot microservices (Go + Python) communicating over gRPC internally and REST externally, behind a Go API gateway. Kafka-driven ingestion and Tree-sitter AST parsing feed the graph and embedding stores; PostgreSQL holds metadata and MinIO holds objects. Full OpenTelemetry → Jaeger / Prometheus / Loki / Grafana observability runs beside an Nginx edge proxy (Compose) and Istio's Envoy sidecars (cluster), with a Next.js 3D graph explorer on top.

• 19 microservices, gRPC internal / REST external
• Dual index: Neo4j (structure) + Chroma (semantics)
• Tree-sitter polyglot parsing · Kafka ingestion · RAG over large repos
• Full observability stack + Kubernetes substrate

A distributed-systems project in the portfolio. 574 commits on develop as of 2026-10-21; the repository is private. (Upgrade branch) marks work on feature/gf-upgrade, 57 commits ahead of develop with its pull request still open.

Architecture

Of the 18 service directories under services/, fifteen are implemented services in the Compose stack, split across two languages: nine in Go (gateway, auth, graph, knowledge-graph, repository, multi-repo-engine, patch-generator, git-provider, architecture-engine) and six in Python (ai-rag, indexing, agent-swarm, agent-runtime, ai-learning, plugin-runtime). The rest sit outside it: search-aggregator and webhook each contain only a go.mod/go.sum with zero source files, and ai has source, a Dockerfile, a CI image and a Helm deployment but no Compose service. A separate workers/ tier — ingestion-worker, migration-runner, patch-validator, cross-repo-analyzer — builds in Compose beside the fifteen, which makes the 19.

The Go side is a genuine multi-module workspace, not a monolith wearing a go.work badge: the workspace file lists all 16 Go modules under Go 1.26.1, and there is deliberately no root go.mod. Every service owns its own module, and container images build with GOWORK=off — each image resolves its own dependency graph instead of leaning on workspace-wide resolution, which matters once 9 services are shipping and deploying independently.

Zero-trust here isn't a slide. Istio's PeerAuthentication sets STRICT mTLS over Envoy sidecars for the release namespace (graphforge under Argo CD), OPA Gatekeeper applies Restricted Pod Security to graphforge-dev, and tenant isolation itself is handled a layer up: Neo4j nodes carry organization_id/repo_id properties, Chroma collections are namespaced per org/repo, and the gateway's TenantInterceptor middleware fails closed (upgrade branch) — a request missing tenant context gets a 401 unless a dev-only ALLOW_ANON_TENANT flag is deliberately set. develop still injects an all-zeros tenant ID when none is set.

How It Works

1. Ingest. Kafka-driven ingestion feeds Tree-sitter AST parsing across the polyglot codebase; the parsed structure lands in Neo4j as the knowledge graph, while indexing chunks and embeds the same code into Chroma.
2. Retrieve. ai-rag vector-searches Chroma, reranks with a cross-encoder (core/reranker.py, on by default) and adds Neo4j dependency and call-chain context. (Upgrade branch) The vector leg becomes BM25 plus Chroma, fused with Reciprocal Rank Fusion (core/fusion.py), with an optional HyDE query-rewrite leg (core/query_transform.py) off by default.
3. Route the model call. develop picks one provider from settings: Ollama, OpenAI or a stub. (Upgrade branch) A FallbackLLMProvider tries Bedrock first and falls back to a local Ollama model, walking a chain from claude-opus-4-6 down to sonnet-4-6 and haiku-4-5 as needed.
4. Delegate to the swarm for anything that mutates code. agent-swarm is a separate LangGraph orchestrator; (upgrade branch) it is durable and human-gated: a Redis checkpointer persists state per thread/mission so a run resumes exactly where it left off, the router's conditional edge fans out parallel tasks via LangGraph's Send API, and an interrupt_before node gates any code-mutating task behind explicit human approval before it executes.