Neoland

Autonomous AI Engineering Platform — Multi-agent ADR pipeline with TUI, Web Console, and Desktop app

Version: 0.0.1 · Status: Release candidate · ROADMAP

The core product is implemented, but a public production release still depends on the environment-backed gates listed below. “Release candidate” is intentional: it does not imply that the soak period, cross-platform installers, or compliance audit have been completed.

---

What it is

Neoland is the orchestration layer that wires a local AI stack together. It exposes a unified REST/gRPC API, runs a four-stage DSPy multi-agent pipeline (Junior → Senior → Architect → TechLeader), and surfaces everything through three interfaces: TUI (ratatui), Web Console (Leptos WASM), and CLI.

Screenshots

TUI — 3-column layout (Sessions / Conversation / Reasoning), 4 themes, chat bubbles, pipeline tree with confidence badges:

│  󰽥 Neoland  │ 󰤣  │ 󰍉 local  │ 󰔎 0ms 󰡱 817d82  󰭹 Conversation                     󰀄   󰢻  │
│──────────────────────────────────────────────────────────────────────────────────│
│╭ 󰙯 Sessions ──────────────╮╭ 󰭹 Conversation ──────────────────╮╭ 󰒝 Reasoning ──────╮│
││  ✚ New Chat  ^n          ││  󰚩 Neoland                       ││  Refatorar módulo   ││
││  󰅂 ⠋ Refatorar módulo…   ││  ╭──────────────────────────────╮││    ├─ 󰄬 Root [92%]    ││
││      agora               ││  │ Claro! Sugiro multiprocessing│││    ├─ 󰄬 Echo [88%]    ││
││    ● Revisar pipeline…   ││  │ from multiprocessing import │││    ├─ ⠋ Lyra 0.0s     ││
││      18m                 ││  │ Pool                        │││    ╰─ 󰡱 ADR accepted   ││
││    ● Otimizar query db   ││  ╰──────────────────────────────╯│╰─────────────────────╯│
│╰──────────────────────────╯╰────────────────────────────────╯                     │
│  ╭────────────────────────────────────────────────────────────────────────────╮   │
│  │ L local │  󰢱 balanced │ 󰑮 Aguardando intervenção (Steer)...                  │   │
│  ╰────────────────────────────────────────────────────────────────────────────╯   │

Web Console — Leptos WASM SPA, same 3-panel layout, CSS artesanal zero deps:

┌─ Topbar ──────────────────────────────────────────────────────────────────────────┐
│  [☰ Sessions]  NEOLAND://CORE  [⚙ Reasoning]                                      │
├─ Workspace ───────────────────────────────────────────────────────────────────────┤
│ ┌ Sessions ────────┐ ┌ Conversation ───────────────────────┐ ┌ Reasoning ────────┐ │
│ │ [+ New Chat]     │ │                                    │ │ Pipeline Tree     │ │
│ │                  │ │  󰚩 Neoland                         │ │  ├─ Junior [92%]   │ │
│ │ ● Session 1  5m  │ │  ╭────────────────────────────────╮│ │  ├─ Senior [88%]   │ │
│ │ ● Session 2  1h  │ │  │ Response streaming via SSE...   ││ │  ├─ Architect ⠋    │ │
│ │ ○ Session 3  1d  │ │  ╰────────────────────────────────╯│ │  ╰─ ADR accepted   │ │
│ └──────────────────┘ └────────────────────────────────────┘ └────────────────────┘ │
├─ Composer ────────────────────────────────────────────────────────────────────────┤
│  [Input box]                                                           [Submit ▶]  │
└────────────────────────────────────────────────────────────────────────────────────┘

Nota: screenshots reais (PNG) podem ser capturadas com just screenshot quando o ambiente estiver rodando localmente.

┌───────────────┐  ┌──────────────┐  ┌──────────────────┐
│   Terminal    │  │   Browser    │  │   Desktop (Tauri) │
│   TUI (Rust)  │  │   Leptos SPA │  │   (v0.0.1+)      │
└───────┬───────┘  └──────┬───────┘  └────────┬─────────┘
        │                 │                    │
        └────────┬────────┴────────────────────┘
                 │ REST :3001 / gRPC :50051
         ┌───────▼───────────┐
         │   Neoland Control │
         │   Plane  (Rust)   │
         └───────┬───────────┘
                 │ HTTP
         ┌───────▼───────────┐
         │  SecureLLM Bridge │  :8080  (mTLS · PII redact)
         └───────┬───────────┘
                 │ HTTP
         ┌───────▼───────────┐
         │   ml-ops-api      │  :8083  (VRAM-aware routing)
         └───────┬───────────┘
                 │ HTTP
         ┌───────▼───────────┐
         │   Inference       │  llama.cpp :8081 / vLLM (opt)
         └───────────────────┘

         DSPy Pipeline      :8001  (Python · FastAPI)
         ADR Ledger         Merkle chain · secp256k1 · NATS JetStream

---

Interfaces

---

Release status

---

Quick start

Requirements

• Nix with flakes enabled (or NixOS)
• PostgreSQL running locally with a neoland database

# One-time: create the database
psql -c "CREATE DATABASE neoland;"

Control plane + TUI

git clone <this-repo> && cd neoland
nix develop

# Start server + TUI together
just dev

# Or individual:
just server          # REST :3001 + gRPC :50051
just tui             # TUI client (in another terminal)

Web Console (dev)

# Single command: server + Web Console on :8080 with Trunk proxy
just dev-web

# Open http://localhost:8080 in your browser

Docker Compose (local full stack)

cd deploy/docker/
cp .env.example .env && $EDITOR .env   # set LLM_API_KEY

eval $(ssh-agent) && ssh-add ~/.ssh/id_ed25519
DOCKER_BUILDKIT=1 docker compose build --ssh default
docker compose up -d

curl http://localhost:3001/health | jq .

Production deployment

Local development defaults are not production defaults. Before deploying with Docker or Helm:

• Generate unique NEOLAND_ADMIN_API_KEY, NEOLAND_USER_API_KEY, and NEOLAND_READONLY_API_KEY values; never reuse the examples.
• Set NEOLAND_JWT_SECRET, database credentials, and provider credentials through a secret manager or the platform's secret mechanism.
• Apply all SQL files under migrations/ in numeric order.
• Keep NEOLAND_REQUIRE_VAULT_KEYS=1; startup must reject development keys.
• Terminate TLS at a trusted reverse proxy or configure native mTLS listeners.
• Use /live for liveness and /ready for readiness.
• Run just validate-all, then the environment-backed just smoke before traffic.
• Take and verify a backup before rollout. Restore and rollback procedures are in scripts/backup/README.md and docs/runbooks/neoland-disaster-recovery.md.

The supported deployment paths are the Nix release artifact (nix build .#neoland-full), Docker Compose for a single host, and the Helm chart under deploy/helm/neoland/. The Ubuntu bare-metal build path is documented in docs/neoland-quickstart.md, but is not yet an audited production path.

---

CLI reference

neoland server     # gRPC :50051 + REST :3001
neoland client     # TUI terminal client
neoland doctor     # environment diagnostics (--json for machine output)
neoland test       # health checks
neoland restart    # kill + restart server

Running neoland without a subcommand starts the server. The concrete entrypoints are src/bin/neoland.rs (Rust CLI), deploy/docker/entrypoint.sh (container), agents/neoland_agents/app.py (DSPy/FastAPI), and web/src/main.rs (Web Console).

Runtime endpoint variables are intentionally separate:

Aliases set by nix develop: nsrv (server), ncli (client), nd (doctor), nt (test).

---

Architecture

Control plane (Rust)

src/
├── bin/neoland.rs          CLI entrypoint
├── server/mod.rs           REST + gRPC handlers · security middleware
├── agents/                 DSPy pipeline client, orchestrator, sessions, escalation
├── mcp/                    Native MCP server (breakpoints + tool routing)
├── tools/                  NativeTool trait + ShellTool
├── auth.rs                 API key auth · RBAC (Admin / User / ReadOnly)
├── secrets.rs              Vault → SOPS → env fallback
├── audit.rs                Structured JSON audit · brute-force detection
├── validation.rs           Input sanitization · path traversal prevention
├── tui/                    ratatui TUI · 4 themes · SSE subscriber
└── storage/                PostgreSQL + pgvector

Agent pipeline (Python · DSPy 3.x)

agents/neoland_agents/
├── app.py             FastAPI · /health · /v1/pipeline/run · /v1/pipeline/session/{id}
├── signatures/        DSPy contracts (4 agents)
├── modules/           Junior · Senior · Architect · TechLeader
├── pipeline/          Orchestrator · checkpoint persistence
└── schemas/api.py     Pydantic ↔ Rust mirror types

Web Console (Leptos WASM)

web/
├── src/
│   ├── main.rs        App component · signal-based state
│   ├── api.rs         REST + SSE client (gloo-net + EventSource)
│   ├── model.rs       Message data model
│   ├── lib.rs         Crate root + unit tests (16 tests)
│   └── components/    5 Leptos components
│       ├── composer.rs      Input box + submit
│       ├── conversation.rs  Chat messages + streaming
│       ├── reasoning.rs     Pipeline reasoning panel
│       ├── sessions.rs      Session list sidebar
│       └── topbar.rs        Header bar
├── public/neoland.css  ~600 lines · zero dependencies
├── Trunk.toml           Proxy config for dev
└── Cargo.toml           Workspace member

---

Testing

# Rust — all crates
cargo test --workspace

# Web Console only
cargo test -p neoland-web

# Python — no LLM needed
cd agents && poetry run pytest tests/ -m contract -v

# Python — requires LLM_API_KEY
cd agents && poetry run pytest tests/ -m integration -v

# WASM compilation check
cargo check -p neoland-web --target wasm32-unknown-unknown

# SLO validation (requires running server)
just validate-slo

---

Security

• RBAC: 3 roles (Admin / User / ReadOnly) via X-API-Key header
• Secrets: Three-tier retrieval — Cache → HashiCorp Vault → env fallback
• Audit: Structured JSON, 15 action types, brute-force detection (>5 failures/min)
• Rate limiting: 100 req/min per user/IP · max 100KB prompt
• mTLS: ✅ End-to-end nativo nos listeners (v0.0.1)
• See: docs/ADR/ for full security decisions

---

Performance

---

NixOS Integration

imports = [ ./modules/applications/neoland.nix ];

services.neoland = {
  enable = true;
  openFirewall = true;
  environmentFile = "/run/secrets/neoland.env";
};

Nix flake provides:

• nix build .#neoland — control plane binary
• nix build .#neoland-web — Web Console WASM bundle (requires network for first build)
• nix build .#neoland-full — full stack: control plane + Web Console served by a single binary (neoland-full)
• nix develop — dev shell with all tooling (Rust, trunk, Python, SOPS, NATS, etc.)
• NixOS modules: neoland · securellmBridgeApi · mlOpsApi · llmSuite · stack

---

Known limitations

• pgvector — vector store runs in-memory; CREATE EXTENSION vector for persistence
• LLM API key — full pipeline requires OPENAI_API_KEY (or equivalent litellm key)
• SecureLLM Bridge Redis — caching disabled without Redis (non-blocking)
• CPU inference — Candle/Qwen is dev-only (~5–10 tok/s); use llama.cpp/vLLM for production
• Nix WASM build — nix build .#neoland-web requires network on first run (cargo deps); cached thereafter
• gRPC-web client — server-side bridge is enabled; the Web Console currently uses REST/SSE
• Non-Nix install — Ubuntu bare metal path documented but not yet validated end-to-end

---

Documentation

• ROADMAP.md — release roadmap and delivery log
• docs/neoland-architecture.md — architecture overview
• docs/neoland-quickstart.md — setup and first run
• docs/neoland-sops-setup.md — secrets workflow
• docs/ADR/ — architectural decisions (016+)
• docs/runbooks/ — operations runbooks

---

License

Apache 2.0

Maintained by: VoidNxSEC Team
Last validated: 2026-08-02 · PR #10 release gate passed Rust, Python contracts, Web/WASM, Docker/Helm, TLS/mTLS and Nix output checks; real-LLM full-stack, authenticated TUI, independent quickstart and public-release gates remain in the roadmap