Security & Reliability

Platform Architecture

Enterprise-grade defense-in-depth with zero local secrets, envelope encryption, and pgvector semantic retrieval.

RFC 8628 Google Workspace Device Authorization

The Friday CLI client never handles user passwords or OAuth client credentials. The RFC 8628 device code flow pairs the terminal session directly with an approved @setu.co Google Workspace account through your browser using PKCE code verification.

1. Device Code Request

Terminal calls /v1/auth/device/code to obtain a short user verification code.

2. Browser Approval

User verifies identity with Google Workspace (enforced domain: setu.co).

3. Token Grant

Backend issues scoped session tokens securely to the local terminal keystore.

pgvector High-Dimensional Semantic Memory

Friday maintains episodic and semantic memory in PostgreSQL 17 via the pgvector extension. Past incident investigations, query patterns, and architectural context are indexed using 1536-dimensional vector embeddings with HNSW cosine distance indexing for sub-millisecond retrieval.

Incident Recall

Correlates new error spikes with historic root-cause analysis documentation and post-mortems.

Service Schemas & RPCs

Indexes internal API contracts, GitLab repositories, and Confluence architecture design records.

Zero-Trust Telemetry & Tool Orchestration

External tools (ClickHouse, Grafana, AWS CloudWatch, Metabase, Jira, GitLab) are executed via backend proxy handlers with strict least-privilege policies. All operations execute with bounded timeouts, mandatory audit logging, and read-only enforcement.

AES-256-GCM Envelope Encryption

All third-party tokens and integration credentials are protected using multi-tier envelope encryption. Plaintext secrets never touch disk or logs, and session tokens are rotated with automated expiry enforcement.