Streaming query feature

Author: Anxhela21

.github/workflows/e2e_tests.yaml

@@ -93,44 +93,51 @@ jobs:
 
       - name: Select and configure run.yaml
         env:
-          CONFIG_MODE: ${{ matrix.mode }}
+          CONFIG_ENVIRONMENT: ${{ matrix.environment }}
         run: |
           CONFIGS_DIR="tests/e2e/configs"
-          MODE="$CONFIG_MODE"
+          ENVIRONMENT="$CONFIG_ENVIRONMENT"
           
-          echo "Deployment mode: $MODE"
+          echo "Looking for configurations in $CONFIGS_DIR/"
           
-          # Select config based on mode:
-          # - library mode: run-library.yaml (llama-stack 0.3.0 format)
-          # - server mode: run-ci.yaml (original format)
-          if [ "$MODE" == "library" ]; then
-            CONFIG_FILE="$CONFIGS_DIR/run-library.yaml"
+          # List available configurations
+          if [ -d "$CONFIGS_DIR" ]; then
+            echo "Available configurations:"
+            ls -la "$CONFIGS_DIR"/*.yaml 2>/dev/null || echo "No YAML files found in $CONFIGS_DIR/"
           else
-            CONFIG_FILE="$CONFIGS_DIR/run-ci.yaml"
+            echo "Configs directory '$CONFIGS_DIR' not found!"
+            exit 1
           fi
           
-          echo "Using configuration: $CONFIG_FILE"
+          # Determine which config file to use
+          CONFIG_FILE="$CONFIGS_DIR/run-$ENVIRONMENT.yaml"
+          
+          echo "Looking for: $CONFIG_FILE"
           
-          if [ ! -f "$CONFIG_FILE" ]; then
-            echo "❌ Configuration not found: $CONFIG_FILE"
-            echo "Available configs:"
-            ls -la "$CONFIGS_DIR"/*.yaml
+          if [ -f "$CONFIG_FILE" ]; then
+            echo "Found config for $ENVIRONMENT environment"
+            cp "$CONFIG_FILE" run.yaml
+          else
+            echo "Configuration file not found: $CONFIG_FILE"
+            echo "Available files:"
+            find "$CONFIGS_DIR" -name "*.yaml"
             exit 1
           fi
           
-          cp "$CONFIG_FILE" run.yaml
-          echo "✅ Configuration copied to run.yaml"
+          # Update paths for container environment (relative -> absolute)
+          sed -i 's|db_path: \.llama/distributions|db_path: /app-root/.llama/distributions|g' run.yaml
+          sed -i 's|db_path: tmp/|db_path: /app-root/.llama/distributions/|g' run.yaml
+                    
+          echo "Successfully configured for $ENVIRONMENT environment"
+          echo "Using configuration: $(basename "$CONFIG_FILE")"
 
       - name: Show final configuration
         run: |
           echo "=== Configuration Summary ==="
           echo "Deployment mode: ${{ matrix.mode }}"
           echo "Environment: ${{ matrix.environment }}"
-          if [ "${{ matrix.mode }}" == "library" ]; then
-            echo "Source config: tests/e2e/configs/run-library.yaml"
-          else
-            echo "Source config: tests/e2e/configs/run-ci.yaml"
-          fi
+          echo "Source config: tests/e2e/configs/run-${{ matrix.environment }}.yaml"
+          echo "Final file: run.yaml"
           echo ""
           echo "=== Configuration Preview ==="
           echo "Providers: $(grep -c "provider_id:" run.yaml)"

.tekton/lightspeed-stack-pull-request.yaml

@@ -333,7 +333,7 @@ spec:
         - name: name
           value: deprecated-image-check
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:462baed733dfc38aca5395499e92f19b6f13a74c2e88fe5d86c3cffa2f899b57
+          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:f59175d9a0a60411738228dfe568af4684af4aa5e7e05c832927cb917801d489
         - name: kind
           value: task
         resolver: bundles
@@ -413,7 +413,7 @@ spec:
         - name: name
           value: sast-snyk-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8ad28b7783837a24acbc9a8494c935e796e591ce476085ad5899bebd7e53f077
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:60f2dac41844d222086ff7f477e51f3563716b183d87db89f603d6f604c21760
         - name: kind
           value: task
         resolver: bundles
@@ -485,7 +485,7 @@ spec:
         - name: name
           value: sast-coverity-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:78f5244a8cfd28c890ed62db7e4ff1fc97ff39876d37fb19f1b0c2c286a4002c
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:ae62d14c999fd93246fef4e57d28570fa5200c3266b9a3263a39965e5a5b02d7
         - name: kind
           value: task
         resolver: bundles
@@ -506,7 +506,7 @@ spec:
         - name: name
           value: coverity-availability-check
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:36400873d3031df128c55aa71ee11d322c3e55fd8f13dc5779098fbc117c0aa3
+          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:36bcf1531b85c2c7d7b4382bc0a9c61b0501e2e54e84991b11b225bdec0e5928
         - name: kind
           value: task
         resolver: bundles
@@ -532,7 +532,7 @@ spec:
         - name: name
           value: sast-shell-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d44336d7bcbd1f7cedee639357a493bd1f661e2859e49e11a34644bdf6819c4e
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:1f0fcba24ebc447d9f8a2ea2e8f262fa435d6c523ca6b0346cd67261551fc9ed
         - name: kind
           value: task
         resolver: bundles
@@ -558,7 +558,7 @@ spec:
         - name: name
           value: sast-unicode-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:e5a8d3e8e7be7246a1460385b95c084ea6e8fe7520d40fe4389deb90f1bf5176
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:1833c618170ab9deb8455667f220df8e88d16ccd630a2361366f594e2bdcb712
         - name: kind
           value: task
         resolver: bundles
@@ -620,7 +620,7 @@ spec:
         - name: name
           value: rpms-signature-scan
         - name: bundle
-          value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:6cfeaece9a338fa89bcaaad00f9f540789a62eaace6cd9fe35add050957405cc
+          value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:3d016c63bcab64ab82da762a52b013c0bcb534e9523b8c0e073cc3a0c02f0cac
         - name: kind
           value: task
         resolver: bundles

.tekton/lightspeed-stack-push.yaml

@@ -330,7 +330,7 @@ spec:
         - name: name
           value: deprecated-image-check
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:462baed733dfc38aca5395499e92f19b6f13a74c2e88fe5d86c3cffa2f899b57
+          value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:f59175d9a0a60411738228dfe568af4684af4aa5e7e05c832927cb917801d489
         - name: kind
           value: task
         resolver: bundles
@@ -410,7 +410,7 @@ spec:
         - name: name
           value: sast-snyk-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:8ad28b7783837a24acbc9a8494c935e796e591ce476085ad5899bebd7e53f077
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.4@sha256:60f2dac41844d222086ff7f477e51f3563716b183d87db89f603d6f604c21760
         - name: kind
           value: task
         resolver: bundles
@@ -482,7 +482,7 @@ spec:
         - name: name
           value: sast-coverity-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:78f5244a8cfd28c890ed62db7e4ff1fc97ff39876d37fb19f1b0c2c286a4002c
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-coverity-check-oci-ta:0.3@sha256:ae62d14c999fd93246fef4e57d28570fa5200c3266b9a3263a39965e5a5b02d7
         - name: kind
           value: task
         resolver: bundles
@@ -503,7 +503,7 @@ spec:
         - name: name
           value: coverity-availability-check
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:36400873d3031df128c55aa71ee11d322c3e55fd8f13dc5779098fbc117c0aa3
+          value: quay.io/konflux-ci/tekton-catalog/task-coverity-availability-check:0.2@sha256:36bcf1531b85c2c7d7b4382bc0a9c61b0501e2e54e84991b11b225bdec0e5928
         - name: kind
           value: task
         resolver: bundles
@@ -529,7 +529,7 @@ spec:
         - name: name
           value: sast-shell-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:d44336d7bcbd1f7cedee639357a493bd1f661e2859e49e11a34644bdf6819c4e
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:1f0fcba24ebc447d9f8a2ea2e8f262fa435d6c523ca6b0346cd67261551fc9ed
         - name: kind
           value: task
         resolver: bundles
@@ -555,7 +555,7 @@ spec:
         - name: name
           value: sast-unicode-check-oci-ta
         - name: bundle
-          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:e5a8d3e8e7be7246a1460385b95c084ea6e8fe7520d40fe4389deb90f1bf5176
+          value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.3@sha256:1833c618170ab9deb8455667f220df8e88d16ccd630a2361366f594e2bdcb712
         - name: kind
           value: task
         resolver: bundles
@@ -617,7 +617,7 @@ spec:
         - name: name
           value: rpms-signature-scan
         - name: bundle
-          value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:6cfeaece9a338fa89bcaaad00f9f540789a62eaace6cd9fe35add050957405cc
+          value: quay.io/konflux-ci/konflux-vanguard/task-rpms-signature-scan:0.2@sha256:3d016c63bcab64ab82da762a52b013c0bcb534e9523b8c0e073cc3a0c02f0cac
         - name: kind
           value: task
         resolver: bundles

Containerfile

@@ -18,7 +18,7 @@ USER root
 RUN dnf install -y --nodocs --setopt=keepcache=0 --setopt=tsflags=nodocs gcc
 
 # Install uv package manager
-RUN pip3.12 install "uv>=0.8.15"
+RUN pip3.12 install "uv==0.8.15"
 
 # Add explicit files and directories
 # (avoid accidental inclusion of local directories or env files or credentials)

Makefile

@@ -43,12 +43,9 @@ schema:	## Generate OpenAPI schema file
 
 openapi-doc:	docs/openapi.json scripts/fix_openapi_doc.py	## Generate OpenAPI documentation
 	openapi-to-markdown --input_file docs/openapi.json --output_file output.md
-	python3 scripts/fix_openapi_doc.py <  output.md > docs/openapi.md
+	python3 scripts/fix_openapi_doc.py <  output.md > docs/output.md
 	rm output.md
 
-generate-documentation:	## Generate documentation
-	scripts/gen_doc.py
-
 # TODO uv migration
 requirements.txt:	pyproject.toml pdm.lock ## Generate requirements.txt file containing hashes for all non-devel packages
 	pdm export --prod --format requirements --output requirements.txt --no-extras --without evaluation

README.md

@@ -6,7 +6,7 @@
 [![License](https://img.shields.io/badge/license-Apache-blue)](https://github.com/lightspeed-core/lightspeed-stack/blob/main/LICENSE)
 [![made-with-python](https://img.shields.io/badge/Made%20with-Python-1f425f.svg)](https://www.python.org/)
 [![Required Python version](https://img.shields.io/python/required-version-toml?tomlFilePath=https%3A%2F%2Fraw.githubusercontent.com%2Flightspeed-core%2Flightspeed-stack%2Frefs%2Fheads%2Fmain%2Fpyproject.toml)](https://www.python.org/)
-[![Tag](https://img.shields.io/github/v/tag/lightspeed-core/lightspeed-stack)](https://github.com/lightspeed-core/lightspeed-stack/releases/tag/0.3.1)
+[![Tag](https://img.shields.io/github/v/tag/lightspeed-core/lightspeed-stack)](https://github.com/lightspeed-core/lightspeed-stack/releases/tag/0.3.0)
 
 Lightspeed Core Stack (LCS) is an AI-powered assistant that provides answers to product questions using backend LLM services, agents, and RAG databases.
 
@@ -163,8 +163,7 @@ To quickly get hands on LCS, we can run it using the default configurations prov
 
 ## LLM Compatibility
 
-Lightspeed Core Stack (LCS) provides support for Large Language Model providers. The models listed in the table below represent specific examples that have been tested within LCS.
-__Note__: Support for individual models is dependent on the specific inference provider's implementation within the currently supported version of Llama Stack.
+Lightspeed Core Stack (LCS) supports the large language models from the providers listed below.
 
 | Provider | Model                                          | Tool Calling | provider_type  | Example                                                                    |
 | -------- | ---------------------------------------------- | ------------ | -------------- | -------------------------------------------------------------------------- |
@@ -1024,4 +1023,4 @@ podman run -it $BASE_IMAGE cat /etc/yum.repos.d/ubi.repo > ubi.repo
 rpm-lockfile-prototype --image $BASE_IMAGE rpms.in.yaml
 ```
 
-This creates `rpms.lock.yaml` with pinned RPM versions.
+This creates `rpms.lock.yaml` with pinned RPM versions.

docker-compose.yaml

@@ -23,6 +23,7 @@ services:
       - RHEL_AI_PORT=${RHEL_AI_PORT}
       - RHEL_AI_API_KEY=${RHEL_AI_API_KEY}
       - RHEL_AI_MODEL=${RHEL_AI_MODEL}
+      - LLAMA_STACK_LOGGING=all=debug # enable llama-stack debug log
     networks:
       - lightspeednet
     healthcheck:

docs/auth.md

@@ -158,93 +158,6 @@ Authentication that checks a given API Key token is present as a Bearer token
 - Same user ID and username handling as `noop`
 - Token is passed through and validated against the API Key given from configuration, for downstream use
 
-### Red Hat Identity (`rh-identity`)
-
-Red Hat Identity header authentication is suitable for deployments behind Red Hat
-Hybrid Cloud Console infrastructure (e.g., console.redhat.com, Insights). This
-method validates the `x-rh-identity` header provided by Red Hat's authentication
-proxy, supporting both User (console users) and System (RHEL systems) identity types.
-
-**Configuration:**
-```yaml
-authentication:
-  module: rh-identity
-  rh_identity_config:
-    required_entitlements: ["rhel"]  # optional, validates service entitlements
-```
-
-The `required_entitlements` field accepts a list of service names. When configured,
-ALL listed entitlements must be present in the identity header. Omit this field
-to disable entitlement validation entirely.
-
-**Identity Types:**
-
-- **User**: Console users authenticated via SSO. Identified by `user_id` and `username`
-  from the `identity.user` object.
-- **System**: Certificate-authenticated RHEL systems. Identified by `cn` (Common Name)
-  from the `identity.system` object, with `account_number` used as username.
-
-**Header Format:**
-
-The `x-rh-identity` header contains a base64-encoded JSON payload. Below are
-examples of the decoded JSON structure for each identity type.
-
-User identity:
-```json
-{
-  "identity": {
-    "account_number": "123456",
-    "org_id": "654321",
-    "type": "User",
-    "user": {
-      "user_id": "abc123",
-      "username": "user@example.com",
-      "is_org_admin": false
-    }
-  },
-  "entitlements": {
-    "rhel": {"is_entitled": true, "is_trial": false}
-  }
-}
-```
-
-System identity:
-```json
-{
-  "identity": {
-    "account_number": "123456",
-    "org_id": "654321",
-    "type": "System",
-    "system": {
-      "cn": "c87dcb4c-8af1-40dd-878e-60c744edddd0"
-    }
-  },
-  "entitlements": {
-    "rhel": {"is_entitled": true, "is_trial": false}
-  }
-}
-```
-
-**Behavior:**
-- Extracts `x-rh-identity` header from request
-- Base64 decodes and parses as JSON
-- Validates structure based on identity type (User or System)
-- Validates service entitlements if `required_entitlements` is configured
-- Extracts user_id (or cn for System) and username (or account_number for System)
-
-**Requirements:**
-- Valid `x-rh-identity` header with base64-encoded JSON
-- Proper JSON structure for the identity type
-- Required service entitlements (if configured)
-
-**Error Responses:**
-
-| Status | Condition |
-|--------|-----------|
-| 401 | Missing `x-rh-identity` header |
-| 400 | Invalid base64 encoding, invalid JSON, or missing required fields |
-| 403 | Missing required service entitlements |
-
 ## Authorization System
 
 Authorization is controlled through role-based access control using two resolver types.