HSAAI is a private, sovereign, self-hosted Enterprise AI Platform for secure generative AI, Enterprise RAG, local LLM inference, Arabic enterprise AI, AI agents, multi-agent workflows, AI governance, observability, and Kubernetes deployment.
HSAAI هي منصة ذكاء اصطناعي مؤسسية خاصة وسيادية وذاتية الاستضافة، مخصصة لتشغيل نماذج اللغة المحلية، وEnterprise RAG، والوكلاء الأذكياء، والبحث في المعرفة المؤسسية، وحوكمة وأمن الذكاء الاصطناعي.
HSAAI was conceived, founded, and engineered by Haithim Nasher (هيثم ناشر), who serves as Principal AI Platform Engineer & Lead Architect for the platform.
His work on HSAAI focuses on private, sovereign, and self-hosted Enterprise AI infrastructure, including Enterprise RAG, local LLMs, AI agents, multi-agent orchestration, AI governance, LLMOps, MLOps, DevSecOps, observability, and Kubernetes-oriented deployment.
- Project: HSAAI — Enterprise AI Platform
- Engineer & Architect: Haithim Nasher
- GitHub Organization: HSA-AI
- Repository: https://github.com/HSA-AI/HSAAI
Software use, modification, and distribution are subject to the repository's LICENSE. Project authorship and attribution are documented in AUTHORS.md, CITATION.cff, and NOTICE.md.
| Capability | Validated result |
|---|---|
| Live Local LLM | ✅ Ollama + qwen2.5:7b-instruct |
| Enterprise RAG | ✅ End-to-End validated |
| Retrieval Precision | ✅ 100% on current controlled benchmark |
| Retrieval Recall | ✅ 100% on current controlled benchmark |
| Citation Precision | ✅ 100% |
| Citation Recall | ✅ 100% |
| Prompt Injection Accuracy | ✅ 100% on current benchmark |
| LLM Grounded Rate | ✅ 100% |
| Required Fact Recall | ✅ 86.61% |
| Retrieval Security Gate | ✅ PASS |
| Publishable Answer Quality | ✅ PASS |
| Overall AI Quality Gate | ✅ PASS |
| Benchmark Errors | ✅ 0 |
| Kubernetes Runtime Acceptance (Kind CI) | ✅ PASS — 12/12 Deployments, 18/18 Pods Ready, 0 Restarts |
| Real External Kubernetes | ⏳ External-cluster acceptance pending |
HSAAI combines Enterprise RAG, Local LLMs, AI Agents, LLM Gateway, Qdrant, Ollama, Keycloak, FastAPI, Next.js, PostgreSQL, Redis, Kafka, Neo4j, MinIO, Vault, MLflow, Prometheus, Grafana, Loki, Tempo, Thanos, Docker, and Kubernetes in one enterprise AI architecture.
Benchmark percentages describe the current controlled HSAAI evaluation suite and are not claims of universal AI accuracy.
تم ابتكار وتأسيس وهندسة منصة HSAAI بواسطة المهندس هيثم ناشر (Haithim Nasher)، بصفته Principal AI Platform Engineer & Lead Architect للمنصة.
يركز عمله في HSAAI على بنية الذكاء الاصطناعي المؤسسي الخاصة والسيادية وذاتية الاستضافة، بما يشمل Enterprise RAG، والنماذج اللغوية المحلية، والوكلاء الأذكياء، والأنظمة متعددة الوكلاء، وحوكمة الذكاء الاصطناعي، وLLMOps، وMLOps، وDevSecOps، والمراقبة، وKubernetes.
- المشروع: HSAAI — Enterprise AI Platform
- المهندس والمعماري: Haithim Nasher
يخضع استخدام البرمجيات وتعديلها وتوزيعها لشروط ملف LICENSE، بينما يتم توثيق تأليف المشروع والإسناد إلى المساهمين في ملفات AUTHORS.md وCITATION.cff وNOTICE.md.
HSAAI منصة ذكاء اصطناعي مؤسسية متكاملة تجمع بين إدارة المعرفة، وRAG، والوكلاء الأذكياء، والأنظمة متعددة الوكلاء، والرسوم البيانية المعرفية، وأتمتة سير العمل، وحوكمة الذكاء الاصطناعي، وLLMOps، وMLOps، والبنية التحتية السحابية ضمن معمارية موحدة وآمنة وقابلة للتوسع.
الإصدار الحالي: HSAAI v4.1.0 — Enterprise RAG Local Runtime
اجتاز الإصدار v4.1.0 اختبارات التكامل المستمر والتشغيل المعتمد لنموذج اللغة المحلي، واختبارات RAG Document End-to-End، والتحقق من بناء الصور وسلسلة التوريد وقبول Kubernetes داخل بيئة CI. أما نتائج التغطية والتحقق النهائي الخاصة بالإصدار v4.0.0 فهي محفوظة أدناه كسجل تاريخي.
يبقى الاختبار على Kubernetes Cluster خارجي حقيقي خطوة قبول تشغيلية مرتبطة ببيئة النشر المستهدفة.
| Area | Verified Status |
|---|---|
| Latest Published Release | HSAAI v4.1.0 — Enterprise RAG Local Runtime |
| Release Status | Published — 2026-10-22 |
| Release Tag | v4.1.0 |
| Release Commit | 23c45bb066497d31bbd135bafddc0e3ef5194a91 |
| Pull Request | PR #29 — 45/45 successful checks |
| Main Branch Validation | 6/6 successful workflows |
| Continuous Integration | PASS |
| Docker Build Validation | PASS |
| Kubernetes Production Acceptance | PASS |
| RAG Document End-to-End | PASS |
| Authenticated Live LLM Answer Quality | PASS |
| Production Image Supply Chain | PASS |
| External Kubernetes Deployment | Environment-specific acceptance pending |
The six successful workflows validate the release commit in the repository CI environment. They do not independently establish acceptance on an external production Kubernetes cluster.
| Verification | Result |
|---|---|
| Kubernetes Runtime Acceptance (Kind CI) | ✅ PASS |
| Kubernetes Version | v1.32.2 |
| Kubernetes Nodes | 1/1 Ready |
| Helm Runtime Deployment | PASS |
| Application Deployments | 12/12 Available |
| Application Pods | 12/12 Ready |
| Data Plane Pods | 6/6 Ready |
| Total Application and Data Plane Pods | 18/18 Running |
| Container Restarts | 0 |
| Internal Service Readiness Probes | PASS |
| Tested Container Image Tag | sha-33ff3f81702c |
| GitHub Actions Run | 39791353596 |
| Test Date | 2026-10-22 |
| External Kubernetes Deployment | PENDING |
| v4.1.0 Image-Specific Runtime Acceptance | Not established by this run |
This test deployed HSAAI to an ephemeral Kind Kubernetes cluster inside GitHub Actions. All 12 application deployments became Available, all 18 application and data-plane Pods were Ready, and the recorded container restart count was zero.
Transient startup readiness warnings were observed for some components; subsequent readiness checks passed.
The tested images used tag sha-33ff3f81702c.
This evidence must not be represented as runtime validation
of the v4.1.0 release images or as external production
Kubernetes acceptance.
| Area | Historical Verified Result |
|---|---|
| Release | HSAAI v4.0.0 — Production Release |
| Release Commit | 80b7806 |
| Final Release Validation | 32/32 successful |
| Backend Coverage | 80.43% |
| Required Coverage Threshold | >=80% |
| Security Validation | PASS |
| Dependency Audits | PASS |
| Authenticated Enterprise E2E | PASS |
| Production Runtime Parity | PASS |
| Kubernetes CI Acceptance | PASS |
| Release Package Hygiene | PASS |
| Artifact Integrity | SHA-256 recorded |
Historical release artifact: HSAAI_v4.0.0.zip
Historical SHA-256:
4e8e69695537adccbc969c4f7a3047ffd844cc46439d3cc86d055da9b6e9c2d2
Real external Kubernetes deployment, production secrets, TLS, networking, persistent storage, backup and restore, and disaster-recovery acceptance remain environment-specific operational responsibilities.
Detailed engineering evidence: Current Release Status
HSAAI provides an enterprise AI control plane for connecting:
- Enterprise knowledge and documents
- Large Language Models
- Retrieval-Augmented Generation pipelines
- Intelligent assistants
- AI agents
- Multi-agent systems
- Knowledge graphs
- Enterprise workflows
- Internal business applications
- Identity and access-management systems
- Model training and evaluation pipelines
- Observability infrastructure
- Security and governance controls
The platform is designed so AI capabilities can operate under enterprise authentication, authorization, governance, auditing and observability.
| Domain | Capabilities |
|---|---|
| Enterprise AI | LLM integration, intelligent assistants, and governed AI execution |
| Enterprise RAG | Document ingestion, embeddings, retrieval, reranking, and citations |
| AI Agents | Specialized agents, routing, tools, and task execution |
| Multi-Agent Systems | Supervisor logic, agent coordination, and orchestration |
| Knowledge Management | Enterprise search and organizational knowledge discovery |
| Knowledge Graphs | Neo4j-oriented graph integration and ontology |
| Workflow Automation | Automated workflows, approvals, and human-in-the-loop |
| AI Governance | Policy, audit, evaluation, and responsible AI controls |
| Identity & Access | Authentication, JWT, RBAC, ABAC, and Keycloak integration |
| LLMOps | LLM routing, provider abstraction, controlled model access, and evaluation |
| MLOps | Training, experiment tracking, evaluation, registry, and lifecycle |
| Enterprise Integrations | Extensible connectors and internal-system integration |
| Observability | Metrics, logs, traces, and dashboards |
| DevSecOps | CI/CD, security validation, dependency auditing, and image supply chain |
| Cloud Native | Docker, Kubernetes, Helm, and production infrastructure |
| Enterprise UX | Next.js web interface with Arabic and RTL-oriented support |
HSAAI provides a Retrieval-Augmented Generation architecture for securely connecting LLMs with enterprise knowledge.
Capabilities include:
- Document ingestion
- Text extraction
- Chunking
- Embeddings
- Vector retrieval
- Semantic search
- Hybrid search
- Reranking
- Citation-oriented retrieval
- Tenant-aware access controls
- Enterprise knowledge discovery
- Knowledge-graph augmentation
Qdrant · PostgreSQL · Redis · Embeddings · Reranking · LLM Gateway · Knowledge Graphs
HSAAI includes an agent-oriented architecture for intelligent enterprise task execution.
Capabilities include:
- Specialized AI agents
- Supervisor and routing logic
- Multi-agent orchestration
- Agent tools
- Task decomposition
- Workflow coordination
- Memory components
- Reasoning components
- Agent execution policies
- Human approval workflows
- Enterprise integrations
AI agents operate behind authentication, authorization, governance and audit controls.
Qdrant-based vector retrieval supports semantic search and RAG workloads.
Neo4j-oriented components support graph-based organizational knowledge, ontology, ingestion and querying.
Enterprise search combines organizational content, semantic retrieval and access-control context.
Document-processing pipelines support structured and unstructured enterprise information.
The HSAAI LLM Gateway separates enterprise applications from direct model-provider dependencies.
Capabilities include:
- Model routing
- Provider abstraction
- Controlled model access
- Generation services
- Model-selection logic
- Local-model integration
- Evaluation
- Quality controls
The architecture supports local model serving through technologies such as Ollama and extensible external model-provider integrations.
HSAAI combines AI execution with enterprise business processes.
Capabilities include:
- Workflow execution
- Automated tasks
- Approval workflows
- Human-in-the-loop validation
- AI-assisted business processes
- Event-driven processing
- Enterprise-system integration
Security and governance are architectural layers within HSAAI.
Key areas include:
- Authentication
- Authorization
- RBAC
- ABAC
- JWT validation
- Tenant isolation
- Policy enforcement
- PII handling
- Audit logging
- Prompt safety
- Output filtering
- AI evaluation
- Secrets management
- Dependency auditing
- Human approvals
See:
SECURITY.mddocs/security/
Never publish credentials, tokens, private keys or exploitable security findings through public issues.
HSAAI includes model lifecycle capabilities for:
- Model training
- Fine-tuning pipelines
- Model evaluation
- Experiment tracking
- Model registry
- Model routing
- Quality evaluation
- Lifecycle workflows
Core technologies include:
MLflow · Ollama · MinIO · PostgreSQL · Prometheus · Grafana
HSAAI/
├── apps/ # Enterprise applications
│ └── web/ # Enterprise Next.js web application
├── services/ # Enterprise service layer
│ ├── __pycache__/
│ ├── ai_alignment/
│ ├── api_gateway/ # Unified enterprise API gateway
│ ├── auth_service/ # Authentication and authorization
│ ├── backend_core/ # Core enterprise backend services
│ ├── collective_intelligence_engine/
│ ├── consciousness_stream/
│ ├── data/
│ ├── digital_twin/
│ ├── dream_engine/
│ ├── empathy_engine/
│ ├── evolution_engine/
│ ├── federation_hub/
│ ├── genealogy_service/
│ ├── governance/ # AI governance and policy controls
│ ├── imagination_engine/
│ ├── immune_system/
│ ├── intelligence_economy/
│ ├── intuition_engine/
│ ├── knowledge_genome_engine/
│ ├── llm_gateway/ # LLM routing and provider gateway
│ ├── mcp_server/
│ ├── model_training/ # Model training and lifecycle
│ ├── multi_agents/ # Multi-agent orchestration
│ ├── narrative_engine/
│ ├── pii_detector/ # PII detection and security screening
│ ├── precognition_engine/
│ ├── proactive_intelligence/
│ ├── quantum_decision_engine/
│ ├── rag_engine/ # Enterprise RAG and grounded answers
│ ├── reflection_engine/
│ ├── singularity_engine/
│ ├── time_travel/
│ ├── wisdom_marketplace/
│ └── workflow_engine/ # Enterprise workflow automation
├── packages/ # Shared platform packages
│ ├── __pycache__/
│ └── common/ # Shared libraries and schemas
├── infrastructure/ # Platform infrastructure
│ ├── alerting/
│ ├── argocd/
│ ├── chaos/
│ ├── dashboards/
│ ├── docker/ # Docker and Compose infrastructure
│ ├── feature-store/
│ ├── grafana/
│ ├── helm/ # Helm charts
│ ├── keycloak/
│ ├── kubernetes/ # Kubernetes deployment assets
│ ├── loki/
│ ├── minio/
│ ├── monitoring/ # Observability infrastructure
│ ├── mtls/
│ ├── multi-region/
│ ├── nginx/
│ ├── opa/
│ ├── patroni/
│ ├── postgres/
│ ├── promtail/
│ ├── qdrant-cluster/
│ ├── redis-sentinel/
│ ├── secrets/
│ ├── service-mesh/
│ ├── slo/
│ ├── thanos/
│ ├── vault/ # Secrets-management infrastructure
│ └── waf/
├── alembic/ # Database migrations
├── benchmarks/ # Engineering benchmarks
├── evals/ # Enterprise AI evaluation assets
├── tests/ # Automated validation suites
├── deployment/ # Deployment assets
├── demo-runtime/ # Lightweight demonstration runtime
├── docs/ # Architecture and engineering documentation
├── runbooks/ # Operational runbooks
├── scripts/ # Automation and validation scripts
├── tools/ # Engineering utilities
├── site/ # Search-optimized GitHub Pages site
├── .github/ # GitHub automation and CI/CD
├── docker-compose.yml # Enterprise runtime stack
├── README.md # Primary project documentation
└── LICENSE # Repository license
HSAAI follows a modular Enterprise AI architecture built around secure identity, Enterprise RAG, local LLM inference, AI agents, multi-agent orchestration, workflow automation, governance, observability, and Kubernetes-oriented deployment.
Validated live AI path:
Keycloak / JWT → Security Controls → Enterprise RAG → Qdrant → Cross-Encoder Relevance Gate → LLM Gateway → Ollama → qwen2.5:7b-instruct → Grounded Answer → Citation Validation
Core platform infrastructure integrates PostgreSQL, Redis, Qdrant, Neo4j, Kafka, MinIO, Keycloak, Ollama, MLflow, Vault, Prometheus, Grafana, Loki, Tempo, Thanos, Docker, Helm, and Kubernetes.
Service availability depends on the selected deployment profile. Directory presence does not imply that every component runs in every environment.
HSAAI integrates with enterprise infrastructure including:
- PostgreSQL — relational application data
- Redis — caching and runtime state
- Qdrant — vector search and semantic retrieval
- Neo4j — enterprise knowledge graphs
- Kafka — event streaming
- MinIO — S3-compatible object storage
- Keycloak — identity and access management
- Vault — secrets management
- Ollama — local LLM serving
- MLflow — MLOps and model lifecycle
Prometheus · Grafana · Loki · Tempo · Thanos
LLMs · RAG · Agentic AI · AI Agents · Multi-Agent Systems · Embeddings · Vector Search · Reranking · Knowledge Graphs
Python · FastAPI · PostgreSQL · Redis · Kafka · Qdrant · Neo4j
Next.js · TypeScript · Enterprise Web UI · Arabic / RTL
Keycloak · JWT · RBAC · ABAC · Vault · Audit Logging · Policy Enforcement · PII Controls
Docker · Docker Compose · Kubernetes · Helm · MinIO
MLflow · Ollama · Model Evaluation · Model Registry · Model Routing
GitHub Actions · Security Validation · Dependency Auditing · Coverage Gates · Prometheus · Grafana · Loki · Tempo · Thanos
A Linux environment with Docker Engine and Docker Compose v2 is recommended.
cp .env.example .env
docker compose config --quiet
docker compose ps --allNever commit production credentials or real secrets.
Termux without a Docker daemon is not considered a production runtime environment.
Deployment assets are available under:
infrastructure/kubernetes/
infrastructure/helm/
Production deployment should provide:
- approved immutable images
- secure secrets management
- persistent storage
- resource requests and limits
- readiness and liveness probes
- ingress and TLS
- network controls
- monitoring and alerting
- backup and disaster recovery procedures
Repository CI validates Kubernetes assets and CI-oriented runtime scenarios.
Real external Kubernetes cluster acceptance remains a separate environment-specific operator deployment gate.
HSAAI uses GitHub Actions for automated engineering and release controls including:
- Continuous Integration
- Full Backend Coverage
- Docker Build Validation
- Python Dependency Audit
- Frontend Dependency Audit
- Security Validation
- Enterprise Runtime Acceptance
- Enterprise E2E
- Kubernetes CI Acceptance
- Production Runtime Parity
- Production Enterprise Wiring
- Production Image Supply Chain
- Final Release Gate
- Delivery Package Integrity
Backend coverage threshold: ≥ 80%
The threshold is enforced by CI.
HSAAI production images cover application components including:
- API Gateway
- Auth Service
- Backend Core
- RAG Service
- LLM Gateway
- Agent Runtime
- Workflow Engine
- Alignment Service
- Governance Service
- MCP Server
- PII Detector
- Frontend
Production image workflows validate buildability and release-oriented image supply-chain requirements.
Current published release:
HSAAI v4.1.0 — Enterprise RAG Local Runtime
Release tag: v4.1.0
Release commit: 23c45bb066497d31bbd135bafddc0e3ef5194a91
The v4.1.0 release passed six main-branch GitHub Actions workflows, including authenticated live LLM answer quality, RAG document end-to-end, Kubernetes production acceptance, Docker build validation, continuous integration, and production image supply-chain validation.
Previous production release: HSAAI v4.0.0.
Release controls include:
- source-integrity validation
- security validation
- dependency auditing
- coverage enforcement
- Enterprise E2E
- production runtime parity
- image supply-chain validation
- package hygiene
- ZIP integrity validation
- SHA-256 artifact verification
The final delivery package excludes private and runtime-only artifacts such as:
.git- private
.envfiles node_modules- dependency caches
- Python caches
- runtime databases
- temporary application state
- generated test/runtime artifacts
Formal project attribution and citation metadata are available in:
- AUTHORS.md — project leadership and engineering attribution
- CITATION.cff — machine-readable citation metadata
- NOTICE.md — attribution and legal notice
Principal AI Platform Engineer & Lead Architect: Haithim Nasher
Category: Enterprise AI Platform
Domain: Enterprise Artificial Intelligence
Software use, modification, and distribution are subject to the repository's LICENSE. Project authorship and attribution are documented in AUTHORS.md, CITATION.cff, and NOTICE.md.
| Resource | Purpose |
|---|---|
| Enterprise AI Platform FAQ | Enterprise AI product and platform FAQ |
START_HERE_AR.md |
Arabic starting point and handover |
QUICKSTART.md |
Getting started |
CHANGELOG.md |
Release history |
SECURITY.md |
Security policy |
FINAL_PRODUCTION_READINESS_REPORT.md |
Readiness and validation evidence |
docs/ |
Architecture, APIs, security, and engineering documentation |
runbooks/ |
Operational procedures |
infrastructure/ |
Deployment and infrastructure assets |
.github/workflows/ |
CI/CD and automated validation workflows |
site/ |
Search-optimized GitHub Pages site |
evals/ |
Enterprise AI evaluation datasets and fixtures |
Historical reports should be interpreted according to the release or commit for which they were generated.
Current CI and release evidence takes precedence over older validation snapshots.
HSAAI is an independent, private, sovereign, self-hosted Enterprise AI Platform founded and engineered by Haithim Nasher (هيثم ناشر).
The project has been submitted to Hayel Saeed Anam Group (HSA Group) as an independent enterprise AI initiative for consideration.
This submission does not imply ownership, sponsorship, endorsement, partnership, or official adoption by HSA Group.
The platform is designed to address enterprise artificial intelligence requirements across organizations and industries.
HSAAI demonstrates how enterprise knowledge, Retrieval-Augmented Generation, AI agents, multi-agent orchestration, knowledge graphs, workflow automation, AI governance, LLMOps, MLOps, DevSecOps, and cloud-native infrastructure can operate within one unified Enterprise AI architecture.
Review LICENSE for applicable rights, restrictions and permitted usage.
This README does not grant rights beyond those defined by the repository license.
Explore the architecture, reproducible tests, security controls, AI quality benchmarks, and engineering contributions: